{"report_id":"b58ea765-9b43-44f2-8a84-dfe625555bf6","version":6,"status":"done","tags":[],"date":"2025-12-19T23:56:31Z","url":{"schema":"http","addr":"sso.gsh-services.com/","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"title":"Welcome to authentik! - authentik","dom":{"size":344,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (344), with no line terminators","md5":"1e12f88d2c8eafb450169150e0e118c2","sha1":"e78fcab5bf45798cc635e8592f58bfcf3be309f7","sha256":"bb5af68b217216f7f8e779f232e09d2790cbee018ce4fced3e400a7e94cddd8a","sha512":"7536350071753b33962b3a146bc55559dd2e8592f6f5361b2e0fbea26b3376acefd0d6b2733ba6d763f090a446a2049b84418c12dc551ae6eeffafc99dcc2ea0","ssdeep":"","tlshash":"7fe020ea2d75c83565e0068610f5e29c163471907611d74452d8dc679e20fd74c6294c","dom_hash":"domhashfa92bf49a0529f3ae8099507699ba65b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sso.gsh-services.com/","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-23T23:56:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"tq2tmylv9quqkoe"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"sso.gsh-services.com","ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-10-26","domain_rank":0,"first_seen":"2025-12-19T23:56:35.156272Z","last_seen":"2025-12-19T23:56:35.156272Z","alert_count":85,"request_count":86,"received_data":4269759,"sent_data":44214,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"authentik.error-reporting.a7k.io","ip":{"addr":"172.67.186.116","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-05-02","domain_rank":1540575,"first_seen":"2023-05-05T18:48:26Z","last_seen":"2025-12-19T05:53:36.14985Z","alert_count":0,"request_count":1,"received_data":1125,"sent_data":663,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/KBWPKQNA.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"0a31185a65e81cb4f47b34dedbdc909b","sha1":"a6d7d79be06ce67dfff4a87cce87a795b9156c23","sha256":"3733f7a83eebff1f96afa552548c60d32a0d69c1cd8f2cb42531c6d6a05206dd","sha512":"427cb8ef420d1471f5d70f935cab8d4374231bbbaf3bc89393b09aed305ab30a828496d3a6edc21b30235062989861ba475ebcf158dc14fe44a00adb93f0b1a4","ssdeep":"","tlshash":"8431228936e8a673417459a6c63e024a750ce4bab1fce8b05300c6a5b1c00a320eff3b","size":1448,"data":"","first_seen":"2025-11-09T11:09:19.458921Z","last_seen":"2026-04-08T19:10:30.718979Z","times_seen":46,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/4V5RU7AR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"b5e70375a93a4380bdc9fa4fd7100226","sha1":"b7d550574df18055bfb0c2847a6524657648a822","sha256":"231736d6546ded76e37a6b592a6eab764ba23d0520ea8e25a16eb8bce9b15bfa","sha512":"1a40245183352ef351947b7268698c0da0507bb5f4ca7faa719d1b453b17d0436523c864991524eee2e5ec9de4d2bc538f2a9f7f08aee02921ef0820798239f7","ssdeep":"192:DZwPZEXZt/sXPuoqYnvZeThn01DgitEpgZkVXM5FNHMLFm/5ZEXNPoo4YRv4W+cP:DZwPZEXZt/sXPuoqYnvZeThn01Drl/5+","tlshash":"16e10544187e4d71562fd3f9914a0708a67ce8c14b3ad85516fd120e0dbab7d53be35c","size":7265,"data":"","first_seen":"2025-06-24T21:11:18.000831Z","last_seen":"2026-04-10T14:05:59.670339Z","times_seen":227,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/standalone/loading/index-2025.10.3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b8e95f14b806da872975c0324a626ff","sha1":"fa87ad7ca9cdab82f710d816efd0d372898e250f","sha256":"9f47d60196ab58bfb7ae792dca6cef49c519d373007bd67c3514d9f1c84cf94e","sha512":"b307560d493d8a31ac15daef65a6891eca0dba7762d84df389dc51dcb0e297a8fcd1b4e8c66720040fa30477324b739a8d1b80b2549da552c9cf4c0af98660f3","ssdeep":"","tlshash":"e3310f0b44f7f5bb0117ccfa809a0f5147406f6be674828871ad16724fb8c82a20f63e","size":1533,"data":"","first_seen":"2025-12-19T23:56:48.595821Z","last_seen":"2026-03-15T23:51:01.063611Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/X7XBOUB2.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"c02d15cd7ce264e3f509fe6e078cadd9","sha1":"b01e5df1b29348b32319b210bad8bd2713eccbc4","sha256":"b4dcce380f54da36b0652484a1aabeef6f6ae87e25bcd6a6824d81dae0f30ddb","sha512":"4c5df56fd6e42f50cd6aab572e7104b77d37e4fcc76fd088aa26cb5fc61b36511af2ef736744b36dfd1d01943f8edc331a65271322f77609d23beabef2708249","ssdeep":"","tlshash":"79017b6f75e8e1b04ae984910b158583b10530e1a1fcc0fcb2bc40ba39a8a46b17d235","size":673,"data":"","first_seen":"2025-11-09T11:09:19.641818Z","last_seen":"2026-04-08T19:10:30.706298Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/HDNCQQEU.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"37f5b9344e49dbf231a5c6a1ab9b225e","sha1":"baeaada7b4ad39e9aa98d464e6b1b1792be753d0","sha256":"0b1ef38b351005c03bbc972e1e1e7a794404fe9fb72ac99bedf8499e6483d506","sha512":"7a11ab0c8ad6874794a091638f90f477c8a4bbb633b0000b00b1eb44d78ed54ce275280b8d014e2e89dc111344865e05a4621ebe98e34d60988498a8375d22a7","ssdeep":"","tlshash":"c831f12fd52e68374e035dc3399e331286e69531533a7a32a40e9e7893945ce01fb634","size":1497,"data":"","first_seen":"2025-12-19T23:56:48.637886Z","last_seen":"2026-03-15T23:51:01.038972Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/YJUVDCXF.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"5e01e6fd314d20f9433204b4e0f0d136","sha1":"4262ed8c5bb17b28b1d067bee49b9531b1d9fb1d","sha256":"d7ffe23d4cb2930ab244cdc7f49465766deed348e669fea280e7af84f2779fa8","sha512":"ba0ec8253f352f749122f4896e47f2a2e74aee901e64c756d0c4a703ce57876071bdd85c48ea1b22b85b240e67e9de3bfc660abefe9a5902d3d93b01aad578d2","ssdeep":"","tlshash":"f5d0c29d60ead6b4a1e35cac210d0e83e1ada025eacc2e90b01ad21543f8490e43ba94","size":279,"data":"","first_seen":"2025-11-09T11:09:19.43664Z","last_seen":"2026-04-08T19:10:30.726535Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JA34RR57.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a80c9778caa48b062231152bcfd37e78","sha1":"287b8483bf2867f708860773e9ac3128c8b8ae27","sha256":"a91dc62aff2ca899604be0dd33175d13292433c41795ae4303e1a96286fd10dc","sha512":"df511bda50b264ba71f2f58e0b6abd2fda903daa2c45ae6d04108b88166716d9e003b99e0eebf0029fcc389b387b9d1e3f1aa22af38ddfa668e92e6338ee41d1","ssdeep":"","tlshash":"be21ce866f7d1b7920dfc2e36d46951275042081f14e4c6c343d4ae897638c620b57f8","size":1166,"data":"","first_seen":"2025-11-14T02:09:21.975712Z","last_seen":"2026-04-10T14:05:59.698338Z","times_seen":58,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NIETNLM6.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"cb39d9d8146fe8d9707db2d40bc956cb","sha1":"51788e52c7fbbcab6278f2900cb4de46655837df","sha256":"747c442aad38cbcdde2e36a572e935b457bbe3ec0b2484254a981289d405e55f","sha512":"1251b5cfc440cef221e67b27ff16cae8c6309c0f75e295cf10149fca95511c7e6a5b1776dca7a08b16307a3dc30f58f486292429df78e38fb6ec1116126f7c7b","ssdeep":"192:UprOBqFAhk/ZXRIiqM6Ob6lrpvHIeDV68WWmonfBzlC0lKKO5:UZgpVSUKt","tlshash":"d4927844687e51be247ee37ee15bc6846bbc2081854cde797cbc97634fa43aa901360d","size":19710,"data":"","first_seen":"2025-11-09T11:09:19.442338Z","last_seen":"2026-04-08T19:10:30.720527Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/K7CAZJZM.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"4c909540d449ad34113aa880d692e53b","sha1":"519db55d111c51a984c1db1fa004442004b9ded8","sha256":"6360d82cb78c61c119431838b862210d1877d681da23fd53fb28b5b6d18b1635","sha512":"be04a45a280ef4f031ec4dabf79e955eff8b3241dfd5df50b61ba981199aaa95ae0e2693c5c98dd40f8080c7ed304483b5913208a28009717ffb7d344da0be16","ssdeep":"192:Qtck3sOgYWGC9AJwk4dVEt9RPtInQUTFmnIRhmHIv9mPIhrL8EKTJONWSRQ/mRba:gtheQcb3Ijzt/8A","tlshash":"28e20940147a427636bfdf7e73e98745136868a0c894859f3cb87a931aedeba31137d0","size":31165,"data":"","first_seen":"2025-06-24T21:11:18.010962Z","last_seen":"2026-04-08T19:10:30.706835Z","times_seen":211,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"99c7ec3a422fe933f3bbe256383ac03a","sha1":"ae01fe34ed4645b4106d3fa5eb07bdab3544f5a0","sha256":"ec8141455b915340f3b2aadd136f290a5af56fc7c72beca3c5fa9e4924e8f114","sha512":"a346a32097514525a371bdf0f56fceb17162b1b5e13e3b7015114a3947ddb02fb26a040ad009575ee7107c92711dc1ea77a9ac2df2518669e8e952178db253db","ssdeep":"192:Hv4fazBltrcIf6i3c8okQS6CjPd80/oxaT3nPMvZCWlcM9MG9SED:P4faBlJcA6i3c8ok56Cbd80/oxaT3PoP","tlshash":"e322e68b3e4d79d610216021b00ba6ca6489ceddd41099819f02d5b4fb3ef26f9ebf4d","size":10329,"data":"","first_seen":"2025-12-19T23:56:48.64959Z","last_seen":"2025-12-20T00:24:36.595225Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/LCNAZTC3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"3b91443c05caa3340c16e3e37a09959e","sha1":"c974cca6dacac15f99477bad91b91695c805b2a0","sha256":"447935e12168887bb47ed9e8ba1f8eae5db9c5412d8559b607f162b2691296f7","sha512":"eae192da7b2258ae1846a68be2cffa9301440da6d39587bd4e7b0c50f53bd5df2d802962e9915e211cb1287aff1807dfc799f8fb02d7befe616846260042b75a","ssdeep":"","tlshash":"2521800944e5c0ba046b8ae1d17527a74a3014a7835c91f8b2ed2fa15f51c86945faae","size":1439,"data":"","first_seen":"2025-11-09T11:09:19.464295Z","last_seen":"2026-04-08T19:10:30.709071Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/LXS4CBUS.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"287a77384d25f42e19a025e509db5b97","sha1":"25dc28da036934a434d4fde309946f19983fe03e","sha256":"fc3a47d7004da5f25f21836e753b994b3c72fc519778a73202560630a7f798de","sha512":"cfd3b8353f2f85b42e62a2c72fccbcbe8dbe9280001e0276d78ff2952ed56f3b160fa71070110cc727c4bf1d79adcbe2be6fd5cda6d1ae7c8a1d074f089a5686","ssdeep":"96:lzljBL6kBfRhBPw+xAdjjNjr8KsY2KJbY1lMyY086iYEMpdYXjlNYn7AC/eerLR3:lhFJx/eOYduQI","tlshash":"6cb17a11187fd0b54f3debb6a35b1b89ea7a584b5cc8c099f68c4a224fe077872117b4","size":5340,"data":"","first_seen":"2025-11-14T02:09:21.98971Z","last_seen":"2026-04-08T19:10:30.725082Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NDP7CTMW.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fe7cad2ca63ae6c86b6bf413e861a395","sha1":"8821b43129e00b24e694a2d4c7f14a8ad2e5553d","sha256":"0fd471b40f848c86db5b42213c0c44087993ec49f06c26991b494cd8b8f6518a","sha512":"196407bfd5928596ed7ba9a321b83b7acc445e46983dc5862497f07d127c86af0dfbe0b52f0f0b3783d589815a02fa0216e767978e6491317c99abea90d608c2","ssdeep":"","tlshash":"03211edfb4c2b67167ab04e2ce77162273296dcb661d4164a0605c64323096fc37ae9e","size":1352,"data":"","first_seen":"2025-12-19T23:56:48.594814Z","last_seen":"2026-03-15T23:51:01.059301Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/UBVAKJV7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"ea8498c7d41b40205b15f490c90dd40e","sha1":"01949710cb962ad5b39dc802277e4ec5fd10e7d9","sha256":"cce54081ecfaf9519de94be6d8cbf953eb351f6f9e9a3516afb2d52fb089c00e","sha512":"9c8163092e6ca13039b6d52d75c75e88827a8c8e4da15d039f680d4ea6e892e60672279a529ddfda061cffdb90e4cca18a4ab74e8002d445001c90005009c970","ssdeep":"","tlshash":"1451ceb67e92b4b073e2f2615c934e514319f984f801c83c3ce858d982e5e8d69fb6b1","size":2930,"data":"","first_seen":"2025-11-14T02:09:22.04018Z","last_seen":"2026-04-08T19:10:30.705159Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/CVDUBLCP.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a50e8a7aaf1293cfcaf257b157354fb6","sha1":"8b2bc54d631548030ec7c79a73840be78edf6046","sha256":"1c82d9dca0d192bae70dcdb74eb7ca19ffab2dbf86853f3d07a23ee763159e76","sha512":"792fdec1b83a766e898271676337b480bbda38dd1765b5715844c17b47f505c0b5ec63d35c14b7bcf779dbe5c9aaa1c6397c17c811aed32bc2b8cdf5842f19ca","ssdeep":"1536:HJe/mxCQ8zNUk5mvAYQ4B0wMx2Oqqb6s3qf5rF6UIZYRzpzOKRyDU0s8tUIoVKaY:O","tlshash":"3833de4112ffd1b424bfe3bef1cb92c85fbe17809a8999325968452319f83ad4f4164b","size":52051,"data":"","first_seen":"2025-06-24T21:11:18.02956Z","last_seen":"2026-04-08T19:10:30.729608Z","times_seen":215,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/GVVRMPL7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"01edf8318cd56fc8b630f27ec138e284","sha1":"a0ac299538eae8b31017d20613417d9cdaf31ca1","sha256":"f0d2989a439aa763e13879ab2f4d445d23da3f0e26fc5fd590403391d5fd7691","sha512":"12280d785a7b849a3418d2b1ae8628635609a2ad29c5341c14938fd13957eabc1ab360343bb08c0e9e22f1d842e82fbbfa6645c4ad20aad2f4c0aa36fbf70062","ssdeep":"768:tThRaxGLcngRXdfznKsOjbsNkyhn72ISv/gpAu0hBQZVC8bSrx8ZfI/jsqRMp3TM:t9RaxURXdW","tlshash":"08f223666f3f0ce631aef339527a4a061aac6cc195f7d98139c0111f4ef53ba66b0247","size":37142,"data":"","first_seen":"2025-06-24T21:11:18.014427Z","last_seen":"2026-04-10T14:05:59.683515Z","times_seen":228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/2LLLUX4Q.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"cef5c3c72c45beb978d0a0d9937c63af","sha1":"faad2a60a7d29d0b032789808445e5d71c090fc0","sha256":"1c0b6ecfcec5c7b7fc5901483900c80b599629ae64a2c3fa06e84b7d8d0d91ba","sha512":"8a0960f7cca0191f677aae3e3364f2f710a81b3e0668e9f6504aadc816b65c6eb8d23693ddd9e7612c4e2ee9e033e42727c975cfd9acb9e36e43808b112af0e5","ssdeep":"","tlshash":"a3f0dc47f6f382b1420b9eefc2089142c31818b8d36113e4d0ee65a623248d2d37ff0a","size":484,"data":"","first_seen":"2025-11-09T11:09:19.512589Z","last_seen":"2026-04-08T19:10:30.718409Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PTH6S4WK.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f8523c76fcd6f5bf9ffa8f4a8d1debf0","sha1":"672ebfb4945626e018e4b785dc171e6c7b35ec1b","sha256":"8cfa4df4031f10dd2dc8eef4545725fdeeab6764a85d1ac5991319860d8d7e64","sha512":"9dc7cf28e3230d056d76867ca81510dc5105e68dcfed2ea0db4415f3d381fcce2c31ecda2ad76b2e40936120ece282145b41a0dd46e60cfcf0c92b2dc8111c29","ssdeep":"","tlshash":"ab117d9a32b773f20be344a8b5164647b31657d6a4064099fd38709d33f6fd0913282f","size":964,"data":"","first_seen":"2025-11-09T11:09:19.500929Z","last_seen":"2026-04-08T19:10:30.71611Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JDUCA4U7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"b15b78f9b0d2bcef544cd38e49f6422e","sha1":"77ee9d6bd8e5832cca01d5809dbe4b3afd321ea4","sha256":"4fcc3f94d9b602aa1472a269dd23366d865071d85d54debb581a6497e04bc447","sha512":"808e5785f60f61777e25890c4b0ea83bbe512b9a91040677d684a52a803eb740c164411b8fa6ed448cd0cc09d2d21ed0a8c2dba3975f1f395a0ecff668836ee5","ssdeep":"","tlshash":"c4c0806f75757df1f90a187d40577441533974e543411084d00150b753244f49e79f18","size":171,"data":"","first_seen":"2025-11-14T02:09:21.943437Z","last_seen":"2026-04-08T19:10:30.717268Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/CXMUDICA.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d24cc2278d414a8bcb448519397d04fa","sha1":"26addf2eb4bb44190386a80877aaf349c99190b7","sha256":"79216a7cf719245824f4cda8b4719d2ac16c15bff4567473f58f6657f5c33550","sha512":"21f56b2e631af189efe9644ff4dce29f7232bca9102e790f3a754af91fb92ebe2cfa4e4f0e58cefb33f7c149d432c06fc1914c976db8210a940c99028129c384","ssdeep":"","tlshash":"83e0261e8c7049f6275218adcb5a594703285966e369d2f4f2cdb92413e9148846f711","size":342,"data":"","first_seen":"2025-11-14T02:09:21.937101Z","last_seen":"2026-04-08T19:10:30.722065Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/II2J7NHT.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"c6920ab5e9797620ffaf5edd0d4881b4","sha1":"d915b85d3154a1922274a4c5d956bdb02e174015","sha256":"77192f7488986402e1086db6f38b4d7575cde681453cc515767c5f76fe9f6dbf","sha512":"57e16274cc7c10a49f6fd6c2988f30d221431cf67f1f188678fcaeb35d32c3104b6873a8f62e89389ab42c3a32063df013edd6a941e023e7df11f5f76cd7cfe1","ssdeep":"","tlshash":"8d21b10a5165c4f60a1f4be9d1a51373823024dd8348a1f8b1fe0aa21f60d51a15ffff","size":1115,"data":"","first_seen":"2025-11-09T11:09:19.418716Z","last_seen":"2026-04-08T19:10:30.712912Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PUGPYTYF.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fa08eb9b3a99e08507d8939dc72ef203","sha1":"29957ae0afe899bc41a1e99bb736b83277da1b39","sha256":"1bcbcf65e0cd69c0bc47c4bd6c9d97176f211ac3cfea3cc5e5f13cec671c8d8b","sha512":"fb460c537b4d2559e66f96a2bc5e8e257b98eaad349f110082d9d8a1f9de799ef36b36e3b4244726b0b82ad6e4d4fba23cee26e30b0e7cb2e2cc3ed2da6f6095","ssdeep":"192:O8kQt7XMHGtVZwGQnBRlUsGUMhK8mVUbTVDDVkhj3wKMbID:OdLccMhKpWR65","tlshash":"a9e184e975d1f266435f8228006e0043fbff58a494091478f07e9995bdbaf10ea76e3a","size":7226,"data":"","first_seen":"2025-11-14T02:09:21.987208Z","last_seen":"2026-04-08T19:10:30.704571Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/TYMPEHLZ.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"c98f977b76a3274ecfd614ad189b3566","sha1":"712de84aff8673ce1b180b9541ccc461ef450706","sha256":"67ea2c2fc1db0ab9bd83b7583ceab300d30d50c6ca37d78352f2ad30d7bce5e1","sha512":"b3e7aaf4ab2f0751d7f4e578b23e4163e67f740afb3323d4cdc4d247a77a0c9c805a263b080fbe4c9c61d5cff15e775afb4d5a34f5b077fc7bcb210e4fb7323f","ssdeep":"384:zu0L0GYDpLC3o2yJ0K3zJnmffgtJPfCAxqq8A/a:a5GYF9jJ0K3zJm8HCz","tlshash":"0782b75473eaa5b24bd9c2919c76010fe29030d8383a442cb678b9ef5468e86b1fdf75","size":17741,"data":"","first_seen":"2025-11-09T11:09:19.434882Z","last_seen":"2026-04-08T19:10:30.730082Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/S7ISSYSE.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"656a8993909de6e768d5b4b5216e942a","sha1":"664c5375f34eecd10366e51f31275a813677376c","sha256":"a020dd8f32e732accacc9088d68acb7911974520056fc3f07a1efa16975e91ec","sha512":"9753eecd9e57fd25890b161af4675e388f48f3c00bc7020bf8c250b4b53024834e32b4ad9a579d0be8cfd1fdddf7ecd7e1194d4510241888ebbafbed7b5b9661","ssdeep":"192:Vq2c9cMWqpIHrW8rpy6DztNG/StZWnAJLaE1OfNsFOnCM:M2c9cXLTrgCxkqKSaEO3","tlshash":"7342c71586b351742e2b46aa961a13c15725a0c7f00c95fd72ecb2f85fec8d5813af39","size":12066,"data":"","first_seen":"2025-11-25T05:22:16.006675Z","last_seen":"2026-04-06T09:43:18.652006Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1121d0b3b801548bf8e4aa2a9e23e0f1","sha1":"76547a1c8a1f7961d4864b081eaaf1e4a5da256a","sha256":"f876066facfc879ab41ff79097636f701dc592bf699bf71208081f2328465fdb","sha512":"5da742a772f8aebf8bbec8c456a6b0d768ae08435f745cc25c2ebef099beb2c97531852c3a7f667f04de9d7bd2d6fe5d6ff75b49a1e1c2bfd2338dee8fb8c298","ssdeep":"384:YUDQtWNGi/zdM+/ZBA7MxmlM970oLIZvearWIui9A:YUYWNF/zdB/ZDYlaABZvJrWtv","tlshash":"d0e2d60285f3443f1a57cbb5e12913526538149bc148e6fcb6ec7be1cfc5c21627aeaa","size":33483,"data":"","first_seen":"2025-12-19T23:56:48.629679Z","last_seen":"2026-03-15T23:51:01.076421Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"49838bb5423e9d91d756299cb5471c0a","sha1":"356dd92c214371f942b4a998539411ea2cb38745","sha256":"fddfacce982961b9f7a428776f31d828c66a8b7c40e9c879c7dd673254558eb5","sha512":"176d1d009648451efb7a67578d1dfb4d896b39a65a4c09e7c04bfcfde6704d5b3e42cd3e1f36c18f0a18220681cba34b03465991b6d3920b17ccdf57741726aa","ssdeep":"","tlshash":"b231b860d7e0287b7291f2e4cdb46eff4aa14a1ac5185c65329c81206b9a8ba4e321b4","size":1779,"data":"","first_seen":"2025-12-19T23:56:48.659824Z","last_seen":"2025-12-19T23:56:52.739088Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f41d46526a55fbe03349b15dc3b4cb0b","sha1":"fd3afa7c22dc62107035bb4c8342cdf55c960ad2","sha256":"6375104c1bedcad0fac7bd6a970673e66fbc0f1d928e4f0b0a43e0d227cda404","sha512":"9c4f58999a2255c007e837f86cfda9a61fbe9a088f485a90df121e4c83e4c7a7a9f7f8b8827a76c6473013b1bf0624ba79f4d449bff01b8c5b3b50712100d28c","ssdeep":"","tlshash":"fb90022692d5254bc6619280937a3e827144463e4508151d104f125825a0603e8050ca","size":55,"data":"","first_seen":"2025-03-03T11:56:05.218747Z","last_seen":"2026-04-12T08:58:42.112182Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/DFWCPF44.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"1484d35f2cc069a72b9cf95a814a3514","sha1":"7178dd9f47f4696d8772544a60b9d3d71d977e34","sha256":"e06eaccaba02453b9abeacacf65e5d20bbdcc7118f714fa302b6a4bbd39e79f8","sha512":"3c7314df4aad1dde512226ac21133fdfa85fe9e761c73bb3dcae2186064fa56b210e22232658c38a8b7cdd1569db36387b7d5ade385806b4590b7fe9dc80e61d","ssdeep":"","tlshash":"07212089106397f91817c8f48b680a01822280cfea58c5e5779c52f10ffe15db1afbed","size":1298,"data":"","first_seen":"2025-11-14T02:09:21.904187Z","last_seen":"2026-04-08T19:10:30.723093Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/GOLPYOWD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"04440f71e1831382763f7c4ebbfcb900","sha1":"4f81c3c7ea05ecc10c544c626af9aa955e9b4f2a","sha256":"f9008711a225ceafa29e34833cfb357c74cdd0dfc049391f1319388c5b47bc99","sha512":"848cb653bcb4dc3383d653d07deb9dd6335af67da94fa46dfbc6536e0f3856d4f5e0750f3bed40a0eb2433badef83450f941e5c5a344477aadde9c3909182277","ssdeep":"","tlshash":"e611dd8e40e710b0890bbcffcad71140a250905bc74dd950b4ee33d1ef2be5a9a82a74","size":861,"data":"","first_seen":"2025-11-09T11:09:19.432174Z","last_seen":"2026-04-08T19:10:30.73631Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/IKZIIFD4.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"172a64d72fe73fb9f135a02b9eefa4b0","sha1":"76d6b60b80677fdce59dba257b9cd0c24aae28c7","sha256":"79fc2b07342aa93c6b6fa8e98c460bf1b21926a68b9b48cfc8cadcd7c5e97b31","sha512":"ec8e7a3dbfefcb7dbcd596000eda5d59e7c58be1acaa4672d98503c4c80c0def5c78c390e2708ca8e4b4931ca34bdce668c814ae538e8089de815aa715b7c14c","ssdeep":"192:71Lv7Em1NYiXYY4R3BHJ+eePDsvphn2dstSLYrsNywZNIRX72maZZSfUUArXNN76:BfEm1N/XYdBHJIQq7mRrkhN7bO5gi3x","tlshash":"4232e8cc76d0f0b692a73670c43f844bf2349835a96c6850a764f5e2b8b546dc26bf39","size":11357,"data":"","first_seen":"2025-11-09T11:09:19.652567Z","last_seen":"2026-04-08T19:10:30.711299Z","times_seen":46,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/U3TJVKBR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f9b51c6372dd8ca2335c14ead454c6ef","sha1":"8ccaeef4b4bb77b55e9d79f7046fa6090871afa5","sha256":"0c95d7ddc397d8e1b58b336e306e1eff6c29fa7163c9221122afea2e22ae855e","sha512":"4c6458c98ee3a38890473ed6aa38b68faeff481fc131494f9138b4b916ac9904c7dbe94229fa985bf776951db861388883556eba98d5b14c1e058e6e68c63e61","ssdeep":"","tlshash":"1cf0781e3ba8e6f30db1269946a55746f23600b8d35481a0f72c809a2b27818c0bbe20","size":610,"data":"","first_seen":"2025-11-09T11:09:19.476867Z","last_seen":"2026-04-08T19:10:30.738114Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/AHNPXFZN.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"001511fb3d2073f89dfa40bfa6441930","sha1":"c5e110401a8ad8d761d170d09bf4c4bac22383a5","sha256":"01fa14dcdd6f79c9b58b3e2b13cd77c815b7693a3f292a3451a4e14ed7be6520","sha512":"e52c2adce7bb13220f1a85bfa9e571e6f6db5edcce44698bdb17fab0aa46eda5a679ed066480efbc50acdc5ece8773d2be7d2c06ec8aad43e04e7ca8727a671d","ssdeep":"","tlshash":"05612c6ef2602a5267c71f92d28365c40171b6b65510d013d88ecfdd3d6e809cb233db","size":3199,"data":"","first_seen":"2025-11-09T11:09:19.516259Z","last_seen":"2026-04-08T19:10:30.731071Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/G32DU7XD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f47d1e93fde4c7d443785cf027578d92","sha1":"d7aec4571de4954edae0834ae410f31fa87a7105","sha256":"d4206aede008b1a8575c3edaa471575e928301cf8e209914107698873251fe5a","sha512":"21131701e7bad427d348d31aa8cf9f5f844b223826fdfd92d3d71d9d6615254b616263cc59a45f197974e5efe7bb0a4375ffcc445a348a41e4a8b6301e0e6026","ssdeep":"","tlshash":"660120bef3a1ad6f2b9d01d5797d804571bcca81584f141cf50d4a6f82106a349e6e30","size":753,"data":"","first_seen":"2025-11-14T02:09:21.938715Z","last_seen":"2026-04-08T19:10:30.727532Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/A34YZ56X.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"2d2f6ed0dccf3df931d6af9b6f068ea7","sha1":"a55f9c40876755ef853a93c6e0935ad4475373be","sha256":"f81acc8374628f7385315d91b6e7c81c12dbe5ccf53ad78a60d742dc10cfa29a","sha512":"faa848b6ee07a1348de537e0a7af8e82705e72ac9fc652c4ec71f8364406a274a7a472078af8e9994ce1d97f308112634bf364328592bfbdd7af1aacd6c6e15b","ssdeep":"96:joA6EpTkQ+YaZCD8iURCQEJahfM5CEhmDnGhfgLT4c4OkGkK8b4gh:OQ+mQeK8bx","tlshash":"fad15e40063a827dad3ffb76916f676ad3ac1cc44c49dc4c54dc02964ae93b9931e2f5","size":6349,"data":"","first_seen":"2025-06-24T21:11:18.04598Z","last_seen":"2026-04-08T19:10:30.715139Z","times_seen":215,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/Y34ISDHX.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"95210c62287e6ca39b65f10b81bed357","sha1":"e8b29e6d66f2ade80c75ed6b8f37bc7897a7a8af","sha256":"140f8f4f55472a0c0f6aace4c0c5ebdf2441a658cac23c305f853b4fc2a43448","sha512":"7e434f1961e980b23b7ec65a33053e4fd26c59b5c715287c30d774f6647da36d5abd33491233adc8ab2853d2231913d340de07aaea93f0a52ed69aa4db8b99c0","ssdeep":"","tlshash":"5ad0eb67317c3eb7527382ac202a8008883451a4b43e0ae4df3055b58ab0488c0eec29","size":282,"data":"","first_seen":"2025-11-09T11:09:19.567249Z","last_seen":"2026-04-10T14:05:59.687271Z","times_seen":59,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/W7G6YGXJ.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"19aebc536eac026a61665b1f751bddd3","sha1":"b83bb36a8a692a25bf6dbf9902c702c22679cb83","sha256":"8252add7de4cd67547afbe5911b0f753665164d47638e5a0eaac932f9980912b","sha512":"c7cdfa73748a3c39b1d57f96a2d6f142a2010da227a55e67de06e62e66fb0673efd3614d57271fcf33ae60f5e3c6565a813a5366bffabf3ca210ec0d6de30d1e","ssdeep":"","tlshash":"dad0a76c77e0a9b7f205812941fb9016911cf1d154450689f041294578a8d48d96af58","size":224,"data":"","first_seen":"2025-11-09T11:09:19.497888Z","last_seen":"2026-04-08T19:10:30.745351Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/7Y4MCTMH.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"87aecadfb57ff305cfd0b55b25d2b337","sha1":"b67c18b22f8a5e977f34ee46c0b81b7d56cf3790","sha256":"bf496605817280d28ab543d2e6cefc91ea9889e4684d54138b5b175b34b7d591","sha512":"35dc94950089e205b24e63b9fe61dcf833bdec11a340964495f19ea0a0cec0ff5422368b1eddd0d0e29ffed32e2e3a214393e8a510e5001714c0654cb644ff26","ssdeep":"","tlshash":"33315352b5d1ab34bef385515a976223b30019d0475042a97534acf4e62a8c0f1bf7f6","size":1570,"data":"","first_seen":"2025-12-19T23:56:48.611108Z","last_seen":"2026-03-15T23:51:01.022456Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/VT355AOK.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"8222de10f38e7a17fa1dbb5b39f04acd","sha1":"d71a948df853aeeabf5dcf9d39684a24674d44d2","sha256":"569d08229511c320d8d958ea2cdfd87e37b924ff6398eaa6dc8efedcf25a4287","sha512":"4887eb176a54db16681c037ca98fe4743004dcb143d596cd77de62aaa2e5ccdad5ac16de1fb80ee8b1026ccddbeb967862b463d9a43e0103106b1a48df31b24d","ssdeep":"","tlshash":"30c0126a28716ffa681a057903199c072277b9f5685503ec5548d8b413aa069a639824","size":189,"data":"","first_seen":"2025-11-14T02:09:21.954235Z","last_seen":"2026-04-08T19:10:30.728638Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PE4KRF7A.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d7306a07cb6669e2f11b5d3f8ee0668d","sha1":"3f19f2b0fc2fc23310816268c8ab341032d52260","sha256":"16e6ac7b81600a1b366bc09b03ae560ca25422b3e1f95ab7272a41529a7cdab1","sha512":"e90d0d1aef125c8fd1b0ccc333a76de56807154a9233e7910af3d4f114ed17a62f651fd44babd57d41108078281986b084dc7ab37c432f132fea1a4e3858afc9","ssdeep":"384:AtKt2G141nNNnkDrdatDbSjfb7dvfmgPT9MhZ/V:ft2G141nNNkDrUtDSb7dvfVPT2Z/V","tlshash":"f67272d573e2b631439b4765a07a4007f77e5dc0510e9228fa2dc8ee3aa8455b2b3f78","size":16713,"data":"","first_seen":"2025-12-19T23:56:48.600429Z","last_seen":"2026-03-15T23:51:01.08909Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/src/flow/stages/identification/chunks/GSHAKA5F.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"36153e985c92d43949098d7417d420d5","sha1":"bbb401197efd85411ecb7a4c4ebda9009bb78901","sha256":"733cdc5a64fe8ce0fe1d3699c15ef63252c9bf4374e74130b2eb7b3b07135b6c","sha512":"7877bae7fa26f90125e39c8a799a24d2f76c75860f074e8f7fb87b3c0b5aacc65edda1798a44aef4caa0ef079996fa684f71f57eb115430c651fcea0d81834de","ssdeep":"","tlshash":"01317fbbc43071574095dcb5e608ae6013328db7b3a42fb6e0ce177dca56137861d421","size":1604,"data":"","first_seen":"2025-11-25T05:22:16.00336Z","last_seen":"2026-04-06T09:43:18.642952Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/ULQE7QTR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"4c76517456de5775c9015e90df707c2c","sha1":"9bb086551f8d65562c758bcf8c12f092fdd5ea81","sha256":"d29827bc2ff7db85b2efb5a7d8de6fec8c71eba65e3564ddd5a7908703c8515f","sha512":"3d66034ee307fb5f5fa8c1fbf8035c680090b0d5cde3fd888f338feba627010c96d8e912cb6086b288bc9752f1bfc6215853877501f0428cf2b4c7778a18fac6","ssdeep":"","tlshash":"1f21005333aef93b41ee815269318093b34160d8b0ed056cb97c71d72529d95d1fdb3a","size":1144,"data":"","first_seen":"2025-11-14T02:09:21.917308Z","last_seen":"2026-04-08T19:10:30.73247Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/6HFXHYTL.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"8bd6f66abff433364b66096ae2599027","sha1":"41015e3915613814ad26b43913bfa6eebdbe738c","sha256":"79d0aae52b30c7dacf99a69e67bf30f86ed17b2c911e537766a59f49b20bd8d2","sha512":"43c4c6ae396ae4367d4055237b5e70e90cf9bb43bf7a1a5ca454880d2e7e3600b9cd800a078231a711aa33c13c7a2cc8f7c51f599401719595ba666dea8a4ac4","ssdeep":"192:dUvcViJFDbxOoU8NpMU0/w//Lbek8HQyCd:EcVcFon+pr","tlshash":"f982941522a358b70ba1c3b1a56006223670d00bd51c94fc7bbd9bfa1f76d829527f3e","size":17628,"data":"","first_seen":"2025-11-09T11:09:19.473201Z","last_seen":"2026-04-08T19:10:30.720008Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/U5FWNNQ3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"ad763cca7d97f101f73779d82288961f","sha1":"d83b8418bba172d97dc87e73b23c78c0fa96a86b","sha256":"33f8a4283258ccc06c06ea0821b431ac027d7838b19bf62714d3c0dfbd759c2d","sha512":"e5bd30f8327a2d391b1df60bd7b2609e66a53733ffa202df7342415fd14bad12405ed127ce7a154e79e895d2bd39c3519b2118734af765fc686439a71bab9fcf","ssdeep":"","tlshash":"da412e0e00a341bd8803dc69cfa6121363b8917bc719e8a57ced568d4f9bcd4ac93379","size":2146,"data":"","first_seen":"2025-11-09T11:09:19.440785Z","last_seen":"2026-04-08T19:10:30.703783Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/KH7NZZE5.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"894eee19b6031d5b9cc2741fbd66101f","sha1":"063016dcd20c64b630fbf570341885d584a5f522","sha256":"3f21cb8086d05289b9d7f8fc9fc92a84eee462c684ffcdbd5cf1764875326ab2","sha512":"5053148f5aa3077bbcd3fe8a939144e1a7d82d49341c80c2ee1ceff209a98bad4daa146bc36e356b899a6834d5ccb7f4e9f2f5201c990b9f67097ecf58ab3fc2","ssdeep":"","tlshash":"cec02bcfe5707bf500d388da803fec937125b0c06f0012c0910046b036304e24025c34","size":131,"data":"","first_seen":"2025-11-14T02:09:22.015777Z","last_seen":"2026-04-08T19:10:30.713476Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/EV62FGFP.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"dca6b11d169af43348aa4561aabd499b","sha1":"9364bf72817d1c07400c05ec77994e3e393b4f87","sha256":"aebffddf94c1a1df3aa5e052071df2f816c51bb56117840759e2cb336dff36cb","sha512":"48a94c978942d24590d83fa5ddf2fe0922be83fa5e196a3f97356aefa70ec9786f0f2a523d85d7642243343fd75504a4119b87574af41cfe7014ae96f2db7040","ssdeep":"24:1Y7O5EyaT3Ozdkwg+rGJc1Oq7yWgTzjVDmPmcOOCmRsojQQXaRLLZbTBs03cMrmF:ZNktTnVMswsmQrH9s+cz34/XNEsLY","tlshash":"fc3239951d7bb4b0d91eeb36dd19b7096f2a2cc68b1abe10cee3ca0606b43f67453144","size":11532,"data":"","first_seen":"2025-06-24T21:11:17.981713Z","last_seen":"2026-04-08T19:10:30.731652Z","times_seen":211,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JHYITNWG.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"7b20627aa6928c65b9bfa33fdf4724af","sha1":"e31b223d0b1e9906b0c3109cd2311741421a7f3f","sha256":"0e87e2c4f12b7cf9cddb2413bd181c073e6a7ac8ff268c1a03b4e92484677596","sha512":"a95382da8f2d0e147354dae2372833d9a3e21ac9ca70d7417f9809ad109eb91808e70b0584a7baf4607e1018179d2f0a5aa7530af6ebf8e5a8c74a12c6708402","ssdeep":"","tlshash":"eb513e0614e1c4ba059bc7f1c1612b232a34a4538348d2f472fc1ba58f72d87906fa2f","size":2645,"data":"","first_seen":"2025-11-09T11:09:19.443876Z","last_seen":"2026-04-08T19:10:30.730596Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/34UXYDLT.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"e8a862da3725802e23bc1422156ceadc","sha1":"533c1e61bd0af606c9157c5d50364fbcc0d2bc52","sha256":"1b7d72ce6344bd6fbb2624024e554df16a270d242fd6589edd4491ea9861cd44","sha512":"af7d3610de234bb5943ba3a6926881f6f5b1f3aa2dbe57709bf741f88080341a994b107dc512645324fc1f644ccbc56eb720b632be5f17e60993b9180783c330","ssdeep":"","tlshash":"6201595bb35452f5128688da98270d22f32162a806dc483cb19843f2d170a46d17bf72","size":847,"data":"","first_seen":"2025-11-14T02:09:22.033575Z","last_seen":"2026-04-08T19:10:30.74322Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/OGLYICC3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"c273aec6a0f9e322ebd7385fccb9c94d","sha1":"b01ce77218d0f2746b048eb6d47a2bb7b383542d","sha256":"87c408ca44b2fc3bd9c7371f36110578a835fd8fd4794a6c9cf01594a3c8ae65","sha512":"73108a0a385d7f8891df0f7f23a829abf4b8fe58bdc921df0ed97cfdcbd0d189824cfc3aafaab67aedae1d9f3920edc4c13569a26e7491e089fbc4a0f581ac62","ssdeep":"","tlshash":"f321df556ef0a0f54396c0b7ad31c00f930074d4250940acb54679fbd968ec6e2e4fb2","size":1181,"data":"","first_seen":"2025-11-14T02:09:21.914233Z","last_seen":"2026-04-08T19:10:30.710293Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/poly-2025.10.3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"375b20e01a94943cec088892771512b8","sha1":"6c2d97008d5918ddb2405744f253f5c6a768c76c","sha256":"8c959ea6a87e00b120216ee8edeb8df5b68efb2673d8c776c0f3248e7ad0783e","sha512":"4352fd6790f9ab848093d8ada7427bfad6237fe2e2d8d876be9b53529d0afe9d2ac48e4af809de9e6c653c6d48de89f6dc12508fee4dac1ebd66a30984606504","ssdeep":"6144:Lq6BgBFrKQEkaa7dczDbE4l574lyAW91MbvJluqlKr/JsIdHDP:e6BuKQb5dA1jAmndHDP","tlshash":"5eb419cd77a2b4a547e760e4143f5447f33729a0940cc069e6d9dce538b8e0e81baeb9","size":505013,"data":"","first_seen":"2025-12-19T23:56:48.608647Z","last_seen":"2026-03-15T23:51:00.98227Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/VOFWSFBX.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"785af21cc0724ebac498304875ae8a45","sha1":"72c2dadbd387816ab495c66245a1716f31378649","sha256":"4be5e72a83b5ad1eab664d12775f04ac4762f7d773f6af27e4262cfb24539b09","sha512":"077a3bbe8b6b86672648b618f5d5b2e839ab2da15c166c8ebfbfab7618b08a43906672d0656c731665ab8f46a8aa6c87e535750641b964045fefbe1f390250ce","ssdeep":"192:zmWcTnzL0TebI18C7gK3jr9g57qsRNOANgejMYcfL0sJU0sC:1e57y3/9g57DRsANgYMYzg","tlshash":"d502a6947451ed778bdb52ca10bf0106e03d25dbe0984ca4ebcce9b626f1d2099bfb25","size":8783,"data":"","first_seen":"2025-11-09T11:09:19.630798Z","last_seen":"2026-04-08T19:10:30.721549Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/35WT7OUR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"582bf8342a7f42c4c1d3f40d59fcad3b","sha1":"c8cae1baf29d38982d1e07fcd1bb64e98074bc80","sha256":"8a0a500560c44833bad17e55b5d16f2cc66945c6c00cfd0e19690b481f9d3e93","sha512":"5729ad8df6a4867c25d40f45029df7a37d14698e41dccd9f105bacea7823f13750c845a12a55c1e4c576c6de265b3034892fb0134d1c5ab6fb02a576c381a599","ssdeep":"","tlshash":"a55160cfd1839133dbed859acc6311129225085c811fceb4ae6bcef1025864ea7d7b7a","size":2541,"data":"","first_seen":"2025-12-19T23:56:48.651414Z","last_seen":"2026-03-15T23:51:01.056654Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PNATKN5E.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f926351573f41c02c6c5eb7b238f8a6b","sha1":"84ad66035521fd385a8d4b32f2f057f20bf6e201","sha256":"dd04164d1a341954224af292cfc60de0565d47b93e47db507fe0f5557261f5dc","sha512":"ea8d47bf2754438a22c658e65515b18889e26dd1281f07226287174a84f32a280853b8f31913e4d1bf1317a76e4edec11e3ebbd54bd57ec4290b8085fc0a5531","ssdeep":"","tlshash":"2341331263a29eba71a0c4e9ddc41121c234a695d3c680bc345c7df4c2b3cc1a2afb7b","size":2089,"data":"","first_seen":"2025-12-19T23:56:48.633885Z","last_seen":"2026-03-15T23:51:01.087809Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/3BX3KQSO.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"0951c41e9c7e6bf9622b7fe0a1b66688","sha1":"cf8661c6167207980c5fe2b60b6e7ddebab2a761","sha256":"45acf4a7d66d2a6e460ec1f2fcd610782b66a986a218e8da75d6e5a57a7af11b","sha512":"518e12a4f5265abaa1c2cc4c09f2f7810e395eea8bcdb86bc8006c19ef3982e80a9b63361aa9a8e4a4b6b1ff7ab9d96ac2df82e5bd725403cda842b1473e22e0","ssdeep":"384:bb6+idldq6h/sLaFOoqc2s35OgwgRvbaNlT4rXfrX6rXGbg6E:bfmr/E","tlshash":"7772c66161a158778b4747b2cb8306821730065e888c64fcbbec75e61fa4c5991abfbf","size":16499,"data":"","first_seen":"2025-12-19T23:56:48.650579Z","last_seen":"2026-03-15T23:51:01.053337Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/MWPG2FFZ.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"88836f516f19229475990e81d97d288a","sha1":"0365a7f5210261c957a3467b26c9bb1dfe2e7486","sha256":"09cbb0805d716861487f6a45a048309f50ab67367e916762928b893226dbc94f","sha512":"d8609c46e3dcd358fc77ec4499f0a4b909d5a79d7d60fa632cb861aa4f93df94f8b92b78dd26e8eeb995a284abf880b33492bb3ebbcc4980f6b2b26dbc4a65f5","ssdeep":"384:S2L2Zv0rOZj8RjieMbMIhuzxHi5DE90Eff8BaFcq9SI0iRnZ32g8/5I:zL2er+j87Mb3huzxHGYaEfoaFcnVi9NF","tlshash":"eea22bad7d457db79fde41d8607b5a0c95bc100ab00c8460e2ceddb518bab98606bf2f","size":22298,"data":"","first_seen":"2025-11-14T02:09:21.933423Z","last_seen":"2026-04-08T19:10:30.743727Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/TVZIPPAC.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f8fff07d9ec9102878f3152b02a64ebc","sha1":"3a40c6fb1ef7f1d76e0f9b9cf0c8b7b785c5f1c7","sha256":"56dd930b8e47ce5eeb9ba3edf168fa1af2b6ea06a67d7365bd21df3bd134eea1","sha512":"d5f8e4b38bf123ed1313483b64948d6a65256e7ca49911e47a2bdc7b46669a9246918195d37f022fcfbf05d9438b3f1e18d7e34f382618b2b13b5f533a5616c1","ssdeep":"","tlshash":"ebf002c77082727ba52345ab4c7a03011a5e14489a095668221477e3927c5d15325f6b","size":607,"data":"","first_seen":"2025-11-09T11:09:19.638113Z","last_seen":"2026-04-08T19:10:30.729145Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/FDUEPPL3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"e22d3c923e2fc3a64514f8aa8d47cba8","sha1":"c8cd8c6f9603dac5dccbae7e6f2c906867a4f2f4","sha256":"9ffe27709d42f0609157732562803d36856562f6986e82eb410505d6f61667b7","sha512":"6ada93f976d6ff85ec5dbe203e00bc2a400cb65863886e1edd56af156d23baf1068146d668b42698a40548228f5804110f194bfb3c1b5f1781c292d3280b453c","ssdeep":"1536:wvUoWH/EvUrNN0KoeDmC71zd2fZuoAUFzcQvea6FYLSt3Djt71ddP7pcQQcSiXSk:Sw+Ur7K5mw/v6Rx9PQviXSKSQgB4eQ","tlshash":"1df3d5e97296b13243eb0335a07b4106f3b95d90544e8128f66cd6de3ba8449a2f7f3d","size":162510,"data":"","first_seen":"2025-12-19T23:56:48.636845Z","last_seen":"2026-03-15T23:51:01.072345Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/DF5VMGPU.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"bc8b311e7ecebe87700b38b51b4c3c42","sha1":"750582ee6474b307f966d516e95dd1b9aa33a6cc","sha256":"a2cc76856009ddba693bb722547bd4ffe25ac5051e4fd1aa098d87f0067493ea","sha512":"73992bc199f4dfb4726cb17cf1b4d98364182d64fbeaa20d44aa253c09af21737e7c4dd0468e2a9d1c6099abe3d13cbc54c966dc50445e0fc801f77c3610cb2c","ssdeep":"","tlshash":"7f2135f96b9732bacbce2468d920150a918c4b2caf58114ab670287319c4880ebf5e98","size":1416,"data":"","first_seen":"2025-12-19T23:56:48.610038Z","last_seen":"2026-03-15T23:51:01.057569Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/AWRPPU3H.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"eba95de720fca57c25ab94ed72c89c8e","sha1":"5533bb5b49c1075d96aeb5c2b5fa3de49573fa3b","sha256":"c2da689abc73c7546fa7a085ec589420c829259d97d257b8d654a4919e8f8eee","sha512":"14dd280da80cad0b63e7989d8d975c968b82f2e69887359b007d9f9e1234d628f9230e3678458ce15438c30d7d56b2a5c95f0e8b0ef28dfd93074d90e4b416b7","ssdeep":"48:JcrcWd30HBuCO2i+a9kAFY+0WlPvIzGg9xQiPCMwcQ+ui/42TiSNFEfhU2dU:DsGA++zxvIzGWxQOCBcQFi//TIy2dU","tlshash":"e7b1b720a8763076357fcbbd91fa870a2b5e304bcd0fd516056cd14a18ad3af573ae68","size":5291,"data":"","first_seen":"2025-06-24T21:11:18.009703Z","last_seen":"2026-04-10T14:05:59.714081Z","times_seen":229,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/EJYCJAOX.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"52f21e1ec13dd4725a47c7f0bbd41912","sha1":"32f8482aad774549a03b866ad8f6b5694d7c8054","sha256":"a39c0352ce0fc0077b5db3856d9c16152a27a2324d15fe1ab5cc09a93b454260","sha512":"d6152f14215a966b42bffe0116c84378dff90432130363291bdbfd9f28e2005e55636c6c4b92a8aec34daf9e955acddf770fc4848c9cd1a4fc4dac061300186b","ssdeep":"384:/g9jktf3Yw4Ysq9UCp9hRd19RjwUgwwO9EdWFTUYEUU+9qWtdFlNR9WOHt7fFB9x:T3Yw4Ysq9UCp9hRd19RjwUgwwO9vTUYh","tlshash":"437208010f7e5a707b3fe3399e6a2f49f72c66414919da0096c3361bce6d2750d62ee8","size":16291,"data":"","first_seen":"2025-06-24T21:11:18.027735Z","last_seen":"2026-04-10T14:05:59.661846Z","times_seen":229,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NDFDKX54.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a33c0bda4e33d2406fea29846b96ee0f","sha1":"4c8065833d9e7f334e5d99aceb76c939f7af6b4b","sha256":"e86e5c9b61c4e2f0a5cda07aef512bbe8558959ea96e6e3ca149e446f20b58a1","sha512":"d85121d5ba89c5bcc9e282a9aed7eb4435c9cdd350c8a006d45b662b2b380174a6d776be9cae7737c6d590c04a95029765433ac470dc66b401dfa1d1d9e4a593","ssdeep":"192:rN9FlsGRJEJBTnEz9Z1fYoT2ZSt/sxGpMAFov8Cqso4ZVbwYmBtqo:/JEJ5vMsx3Eov8/4TbMtqo","tlshash":"ceb22810553a447779bee3f6e2cb4a18a39c1882c908d8d1be7c4a574fa07bb71327e5","size":25547,"data":"","first_seen":"2025-06-24T21:11:18.008658Z","last_seen":"2026-04-08T19:10:30.72459Z","times_seen":212,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/QT2F33W7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"5aa4469f9bdd1a5e95c495c9d90db483","sha1":"d13c19ab700951a882d266e004c7b1d95b0439f7","sha256":"0de295cc9950643728f280886380e756b9f2b0f4671b22ee915714374178bdd4","sha512":"24647557622440d225a417dd7bdd8a5b01febcc07182c79075458433baabf9de9fa50bb73c213a067547f2e0ded0320554dd345c7e2895293bde287f1c3ddc53","ssdeep":"96:5o14SmXLJIL/iL9nIFOcqK/OBGdAPtjhjX5SxYOrUHnlaCcWHOI2TzM:aFqLuFOl/HDCYOmtwzM","tlshash":"e532fc40287a6df7672fd7be51af520c63b934c3884accd048be461e6f65bae62121d4","size":11533,"data":"","first_seen":"2025-06-24T21:11:18.015545Z","last_seen":"2026-04-10T14:05:59.664462Z","times_seen":227,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/T7AW6YFM.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"f613e16f40758598413fa96de7a29b08","sha1":"c5d95d05d35dd5d4df9ab90149178a14e9f6688a","sha256":"ea1fe612d2c635e87463979233c56480a97a0e4882045e4bb69384bb438adcb8","sha512":"1203547511d93f784d35857015482c03630018243cdb839d5f3d56f5a6298defefef4f5c57bb9f4bb56bd76838891c945e803c196cf19c02a3de6ff8d314fcd5","ssdeep":"","tlshash":"0c2111a72ab87bb94ff888d64836c4a173e1d4b993ad1c64d618376b1150843c0d3f22","size":1375,"data":"","first_seen":"2025-11-26T19:07:07.884765Z","last_seen":"2026-03-15T23:51:01.077223Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/OSXVNBF2.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fb019aa73601310849e65da4f1e52260","sha1":"49d8442aab15cd9e1086bcd201202eeb2c1a412b","sha256":"4ceb674824b25e14649b164c44591da0db30d45f8e748974c544f87d5c84c5eb","sha512":"fbd6934086ca12c40c69bf21efeb3c78c33d93f2dde87eea71b90effd99838eb0b3e9de7ee2434c1b13848b684f29d35af7c29edc20af406eaf21d7c50443c1b","ssdeep":"","tlshash":"0951cf40943f48bf66bde77ba14bc6d623ade442cdbccc405ae8036e19b23ed51121b5","size":3055,"data":"","first_seen":"2025-06-24T21:11:18.018275Z","last_seen":"2026-04-10T14:05:59.684036Z","times_seen":228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JEYV3VGD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"e49f7eea550e76bde338dc094c38ae62","sha1":"77560340c97a69f8167af7a63b1f2f5dc02d2975","sha256":"ca6a2a77fe07fc4ae6ffc4418eb0266c8457b195a6ab07e323c67ef6ccd284cb","sha512":"9ade9fa568e0c701374c95bf4c810d71ea4efd76e5c2f3589aab28a169262e8b81891b8a9cd07734925b3d3def66079f6423da5dbcb7887a635cb9bccbc6166f","ssdeep":"","tlshash":"c55166af73d7b667c71611b1885f6402b67a1a81604d5598f308a1a330b5cecc3f3e6e","size":2917,"data":"","first_seen":"2025-11-14T02:09:22.018936Z","last_seen":"2026-04-08T19:10:30.726065Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/IENAWGHD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"ee1b19e9f6b004e095e25260c45bbfe4","sha1":"14ec50e68ff31a56151ecbe848c5554f83f2c850","sha256":"dd575862985e79725438c6ccbe0adedddaa9d3ed34c7df4d4fa2bc5066af0a36","sha512":"9fff0336c88547aa4fc421d44e3595210d2070881d3be31052b563bba1a0e2ad6d73140ab6afd67f760383db0c80efceeeb711b6042f39180937f76663fb8676","ssdeep":"","tlshash":"0311ef462aebd4f7f327c5f480a6121652215c9b8b648485f2ada7b88f70c51f252a3d","size":942,"data":"","first_seen":"2025-11-09T11:09:19.611495Z","last_seen":"2026-04-08T19:10:30.724108Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"387499b8ea9f2d3aa8bb225aebe4f793","sha1":"af56de3e40a4c0e21b0302c8a1f632ac4e4edf16","sha256":"cd7ede21cc09f844f7a69065b001bbc2aa097e42054bf3c9fe4c7168fe4e758d","sha512":"cb2a0634d449807df40409a65d8fd451e5d385943b33e815f8adc2e531b67a63c3b62bc811f187ec99d53c67f370e11355fe97eed45bf8303fe98d5d729d4d82","ssdeep":"","tlshash":"74d023d639308c3011c4010710b5d3dc263030903721e38082dccc1b6e30fd304b050c","size":217,"data":"","first_seen":"2025-12-19T23:56:48.661321Z","last_seen":"2025-12-19T23:56:48.661321Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NQNIGDVT.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d918b0bbe3fcd4f5482af7b8f9469390","sha1":"4551fbcb8613b7233b5ba66519346b5b390ab0ee","sha256":"bfe90818e73f4cff72c8ed895eb0207e3538a8d52335585bfffd631ee4fd489b","sha512":"ff6a03fd3b289187847bbcf8681ab833fd1efc5693c5f1f6616ea5796b4740d7fb13bf0e492735c0e6b9737f43e1de53d84cc28349d42152d61b2223fd0f199c","ssdeep":"192:k4h9TkOTpRyewmRAYmbP9FZemNxaVCuXOTOROeOEETP6Ri69nk24+OgOg:pWP9FZn5il1Qg","tlshash":"6bf2e68218ba4339377fdb7e61975348f3be3cc58858ea45199cd6b208f436d225e782","size":34252,"data":"","first_seen":"2025-06-24T21:11:17.983568Z","last_seen":"2026-04-10T14:05:59.669841Z","times_seen":227,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/Q56UXRL5.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fff9801ed622b1662fc4f490b7fe057d","sha1":"3023ee2c3434f9c70d49731cbf9ef4a76d6dc917","sha256":"eefff7a74b70562317c4f546f370ee2d6a38b6fb3b693545c68b9d816c1876f2","sha512":"0682fd6d8b8b1529fc14b6246be4112c72f8720d418423d849bb0dd2b14e7ee21acea6d7b01841a8efb4feace5394139eddad4f30d0e5d2b37004f0ebef20526","ssdeep":"","tlshash":"2fb02b8f9b3c38f68c3b052f000b40c8154001cc76000108a20305534031a834440ce0","size":123,"data":"","first_seen":"2025-11-09T11:09:19.583389Z","last_seen":"2026-04-08T19:10:30.740221Z","times_seen":46,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/XW2HY2O2.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"b4ee969f005f6348366e35105be13231","sha1":"e45d1c2798b4932f93ee979d09e48797028072e4","sha256":"d24cab07f0eaad4e00d869387c822657ce5877ae9123ac0b888ab66ba4a20a17","sha512":"06db5ea9868522279b646d7ae0a9b53d49aa228d62462a2de514ac74a8a31c42c5504161c75cac8769037953e24cf0f88c264690fff633a6aa8e77f0d2b1b47b","ssdeep":"","tlshash":"e2b012578cf869f458d70cdd505a9d83452410e9a75132c06010662412314c6d10ac22","size":101,"data":"","first_seen":"2025-11-14T02:09:21.992184Z","last_seen":"2026-04-08T19:10:30.707368Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/F5NDAKRD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a4fa2c017e3d33cf980794284f93b96f","sha1":"450077395b124374094a67e04740e9f676f0ce29","sha256":"58bf8a75520a9d63c6eab8fed9904899ee42a5235a6a3f55789ca9a45cb055df","sha512":"27f7ffe56f840f8ef22477c628599211258e1b01701b542f39100389791357b689e4db7d8e0838388f5086c28455c814051bc98883692780e62695f7d462413e","ssdeep":"49152:Cl9rccNh9gg1js7I355qUvkKGD8sD7l5ak2ev4uQnwHgWA3ODHV4:eZ","tlshash":"39852bd1b73f7d22a36bd966f8a70302d3799154e12d5028bb7c6cfb2244109862ef76","size":1847845,"data":"","first_seen":"2025-11-09T11:09:19.600914Z","last_seen":"2026-04-08T19:10:30.750508Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/MBXKWPCC.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"1218080a2fd189ee4d347620637e7300","sha1":"27504307ca0f9272e7a81fe7777234b874b5ae8c","sha256":"1d97a18aafab9a3adcacdb72190f592265af07b237db21c263b15a3ea47cb28c","sha512":"b97276a36ed8f394caa531e71fbc5213d9d38a80231b9708dc0079c2fe0a371f7e1aa7eabc4c222904b4c9116ac7470852b2516028ce2de2c38cb097d56a44b1","ssdeep":"1536:+f+WqZ/BkK9jNY6NHbOO7fAQj8NqI72zZE6H/lBP2seiH6jMjdp+/j66WwD4uleG:+WWQvHHb7LIyzi6HbP2seiur0AJ8s","tlshash":"9cd32a5e934422760e93c2f2be8a55e0eb7a702d6792414076edc2bc136287dd77b7e0","size":130864,"data":"","first_seen":"2025-12-19T23:56:48.589804Z","last_seen":"2026-03-15T23:51:01.075232Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/6UOMW4P6.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a634dd4ae46f0b3a29cb8913c45cd310","sha1":"1c6a3e63134727d4d567e9950d3dbdf34133c392","sha256":"0287185027f8ff6970c9713e52de9217cb08adb36f01b48913d5b52be9f4eb07","sha512":"773d8075346afe886ac59bdcb2790cdd4eab6ebddc6d823f82791d0e5115155eb441bc0b355d9551d9cf6ddd74f76094d7a286725c5d1344d2c256fc9dd7e40e","ssdeep":"96:x80Ae+70kGlaqxYMbOYMWorC1FguxuTlK4eL8ats:x8jqacYIcWoYK84/","tlshash":"609194a733d9497242dfd7d7a53a901d625060e9a4b8892c701fadab0734dc270a2b38","size":4505,"data":"","first_seen":"2025-11-14T02:09:21.945416Z","last_seen":"2026-04-08T19:10:30.727051Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/GIGOTIVB.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"56b92a9d6aa7f8ae87dbf24b98dc0358","sha1":"290dbcf6205b530d14a8cba9022dde1f1a85afba","sha256":"54ce6aeee4d300c35b4d168654ef11a6b2a64c874105e94c858248c8fa772f27","sha512":"87f95095134f4e46992ac31028db051689d42cdc9aa3fe45a32a8c15b43e18a208470f01bdffe325ef9c64c96d05d7105a89619e752ce6d68d2b262f1989dfdc","ssdeep":"96:bqrceNDd09PJyYLfX/PVB3+K6TusA0uQ388:bcdqPpbPVl+KquQ3H","tlshash":"14b13fe879d2f57293c3016ac0ef6409f2294899605ca834f3a9edda3935528d2b7f34","size":5225,"data":"","first_seen":"2025-12-19T23:56:48.593855Z","last_seen":"2026-03-15T23:51:01.078943Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"748ab3d61eee728b46f2810e78475035","sha1":"012134fc88b8466f4318ad8bf04a550e72540ded","sha256":"70f070a2dd3c4526898ae6655e8aab2e3d421ded0ad02f9181321fff96589935","sha512":"d61ae0753c007a22994fb1a7cffe55c8edaec9309a5acc0aeacd7e31cfc9428bd36e906e0041edec4e61968650c712fe35314468bc2ec2ebf1b4bca79df273f0","ssdeep":"","tlshash":"d311c4753b155534c5c54147317de7a93d3260617a02d184c36cdc255d28e9714efdbe","size":902,"data":"","first_seen":"2025-12-19T23:56:48.663561Z","last_seen":"2025-12-19T23:56:48.663561Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JEYV3VGD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/JEYV3VGD.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1409\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 2917-77560340c97a69f8167af7a63b1f2f5dc02d2975\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CHmAo9CPGHn7GOR7o8Aq8NVVEB7sFnRbjVvDwpXNw3JZ6Wi9YQF%2FqkP0nUQoROOR7QKGRXlLwznGYD4CLXL7xwQSFlGXzPxCMH415tkS72rXDw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c3b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2917,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (2879)","md5":"e49f7eea550e76bde338dc094c38ae62","sha1":"77560340c97a69f8167af7a63b1f2f5dc02d2975","sha256":"ca6a2a77fe07fc4ae6ffc4418eb0266c8457b195a6ab07e323c67ef6ccd284cb","sha512":"9ade9fa568e0c701374c95bf4c810d71ea4efd76e5c2f3589aab28a169262e8b81891b8a9cd07734925b3d3def66079f6423da5dbcb7887a635cb9bccbc6166f","ssdeep":"","tlshash":"c55166af73d7b667c71611b1885f6402b67a1a81604d5598f308a1a330b5cecc3f3e6e","first_seen":"2025-11-14T02:09:22.018936Z","last_seen":"2026-04-08T19:10:30.726065Z","times_seen":30,"resource_available":true,"data":null}},"time_used":321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/IKZIIFD4.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/IKZIIFD4.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/poly-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 11357-76d6b60b80677fdce59dba257b9cd0c24aae28c7\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fKkfE9Jm82OguGLYAnEENLGhMgao35NBEPE8%2ByOQyE9dNOt3fRgES%2F80iJ5sJKoFDUx7%2Fyn9Lv84cG3E5iMlMAPaPqjReDzfZVN9JDfWGO9q4w%3D%3D\"}]}\r\ncf-ray: 9b0ad5bd2a4db4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11357,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (11319)","md5":"172a64d72fe73fb9f135a02b9eefa4b0","sha1":"76d6b60b80677fdce59dba257b9cd0c24aae28c7","sha256":"79fc2b07342aa93c6b6fa8e98c460bf1b21926a68b9b48cfc8cadcd7c5e97b31","sha512":"ec8e7a3dbfefcb7dbcd596000eda5d59e7c58be1acaa4672d98503c4c80c0def5c78c390e2708ca8e4b4931ca34bdce668c814ae538e8089de815aa715b7c14c","ssdeep":"192:71Lv7Em1NYiXYY4R3BHJ+eePDsvphn2dstSLYrsNywZNIRX72maZZSfUUArXNN76:BfEm1N/XYdBHJIQq7mRrkhN7bO5gi3x","tlshash":"4232e8cc76d0f0b692a73670c43f844bf2349835a96c6850a764f5e2b8b546dc26bf39","first_seen":"2025-11-09T11:09:19.652567Z","last_seen":"2026-04-08T19:10:30.711299Z","times_seen":46,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/flows/-/default/authentication/?next=/","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-19T23:56:08.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /flows/-/default/authentication/?next=/ HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Fri, 19 Dec 2025 23:56:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=haDWVeEQe9fBQdG2%2BAyokGyPVXO4a6JWYbDQ16qrcgYcRs7BVhUarGv5kcUkRq8CukgL7mz1c%2BKGao5CPE4SR2Mttl8UHYkuUkBvgduK8Pv1BQ%3D%3D\"}]}\r\ncontent-language: en\r\nlocation: /if/flow/default-authentication-flow/?next=%2F\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\nvary: Accept-Encoding, Accept-Language, Cookie\r\nx-authentik-id: 1fc9c7c238344ae1a620dccc47a8edff\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: authentik\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0ad5b67e1ab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4736,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-12T12:55:59.554947Z","times_seen":13662418,"resource_available":true,"data":null}},"time_used":260,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/U5FWNNQ3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/U5FWNNQ3.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 780\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 2146-d83b8418bba172d97dc87e73b23c78c0fa96a86b\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=04iZiiWzvyoB88JKb1HoF3UjoDuyXSFPpXY7mBqa%2Bna0VYPo0IfTX7dfTBJuNwUveMDlOdr%2F3LR0N4qp3aOJRPiK4flVvxioyLvBDKvzsHYgdg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf972b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2146,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (318)","md5":"ad763cca7d97f101f73779d82288961f","sha1":"d83b8418bba172d97dc87e73b23c78c0fa96a86b","sha256":"33f8a4283258ccc06c06ea0821b431ac027d7838b19bf62714d3c0dfbd759c2d","sha512":"e5bd30f8327a2d391b1df60bd7b2609e66a53733ffa202df7342415fd14bad12405ed127ce7a154e79e895d2bd39c3519b2118734af765fc686439a71bab9fcf","ssdeep":"","tlshash":"da412e0e00a341bd8803dc69cfa6121363b8917bc719e8a57ced568d4f9bcd4ac93379","first_seen":"2025-11-09T11:09:19.440785Z","last_seen":"2026-04-08T19:10:30.703783Z","times_seen":31,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NIETNLM6.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/NIETNLM6.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 19710-51788e52c7fbbcab6278f2900cb4de46655837df\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Nb738bADdfPpxzgTYru8FioT8%2Bm%2FNY%2F93FBjmNn9Iq9pH56Zf1P3o%2FXBlYTnrdPfIRwT5N2BXT%2BVABy0290ldpU79E84Xajt3bAAonLRutkQqQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf978b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19710,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (1508)","md5":"cb39d9d8146fe8d9707db2d40bc956cb","sha1":"51788e52c7fbbcab6278f2900cb4de46655837df","sha256":"747c442aad38cbcdde2e36a572e935b457bbe3ec0b2484254a981289d405e55f","sha512":"1251b5cfc440cef221e67b27ff16cae8c6309c0f75e295cf10149fca95511c7e6a5b1776dca7a08b16307a3dc30f58f486292429df78e38fb6ec1116126f7c7b","ssdeep":"192:UprOBqFAhk/ZXRIiqM6Ob6lrpvHIeDV68WWmonfBzlC0lKKO5:UZgpVSUKt","tlshash":"d4927844687e51be247ee37ee15bc6846bbc2081854cde797cbc97634fa43aa901360d","first_seen":"2025-11-09T11:09:19.442338Z","last_seen":"2026-04-08T19:10:30.720527Z","times_seen":31,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/GVVRMPL7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.981Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/GVVRMPL7.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 37142-a0ac299538eae8b31017d20613417d9cdaf31ca1\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vYvIvhw%2FTsl5mICs4kQojiDPRtgDwqdK2uoH%2F%2FpAOaJtnRf7AgRFWkM8TImN5o81n7HLp%2BrDY8aevLhdYVPiJu%2BxXpalyT7iYw9o698FeFjgPQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc1999b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":37142,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"01edf8318cd56fc8b630f27ec138e284","sha1":"a0ac299538eae8b31017d20613417d9cdaf31ca1","sha256":"f0d2989a439aa763e13879ab2f4d445d23da3f0e26fc5fd590403391d5fd7691","sha512":"12280d785a7b849a3418d2b1ae8628635609a2ad29c5341c14938fd13957eabc1ab360343bb08c0e9e22f1d842e82fbbfa6645c4ad20aad2f4c0aa36fbf70062","ssdeep":"768:tThRaxGLcngRXdfznKsOjbsNkyhn72ISv/gpAu0hBQZVC8bSrx8ZfI/jsqRMp3TM:t9RaxURXdW","tlshash":"08f223666f3f0ce631aef339527a4a061aac6cc195f7d98139c0111f4ef53ba66b0247","first_seen":"2025-06-24T21:11:18.014427Z","last_seen":"2026-04-10T14:05:59.683515Z","times_seen":228,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PUGPYTYF.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/PUGPYTYF.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 7226-29957ae0afe899bc41a1e99bb736b83277da1b39\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4o9FbOOVsfTWwnwCZPwx8ucXgo2L1%2FAVG730Z2d24KaUWnd5UGLZW1C3Tsb6uJNWRqndnlK8sXEDkvmA0vf5MBCb9PhfKq7bZWqj3X12LW0fyg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc199fb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7226,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (7188)","md5":"fa08eb9b3a99e08507d8939dc72ef203","sha1":"29957ae0afe899bc41a1e99bb736b83277da1b39","sha256":"1bcbcf65e0cd69c0bc47c4bd6c9d97176f211ac3cfea3cc5e5f13cec671c8d8b","sha512":"fb460c537b4d2559e66f96a2bc5e8e257b98eaad349f110082d9d8a1f9de799ef36b36e3b4244726b0b82ad6e4d4fba23cee26e30b0e7cb2e2cc3ed2da6f6095","ssdeep":"192:O8kQt7XMHGtVZwGQnBRlUsGUMhK8mVUbTVDDVkhj3wKMbID:OdLccMhKpWR65","tlshash":"a9e184e975d1f266435f8228006e0043fbff58a494091478f07e9995bdbaf10ea76e3a","first_seen":"2025-11-14T02:09:21.987208Z","last_seen":"2026-04-08T19:10:30.704571Z","times_seen":41,"resource_available":true,"data":null}},"time_used":382,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":382,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/DFWCPF44.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/DFWCPF44.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 628\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1298-7178dd9f47f4696d8772544a60b9d3d71d977e34\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WxT%2BcUhJ3CbLhKdjrNuXoUBE1Bzjn1OQhevZgguIVNl6v2rvbRTwyGOAHR6S8tgXgI4U2Ug%2BilGYbGP1yQUgVngp%2B9a6uErawGoF%2Fh0XLpqKWg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19adb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1298,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (344)","md5":"1484d35f2cc069a72b9cf95a814a3514","sha1":"7178dd9f47f4696d8772544a60b9d3d71d977e34","sha256":"e06eaccaba02453b9abeacacf65e5d20bbdcc7118f714fa302b6a4bbd39e79f8","sha512":"3c7314df4aad1dde512226ac21133fdfa85fe9e761c73bb3dcae2186064fa56b210e22232658c38a8b7cdd1569db36387b7d5ade385806b4590b7fe9dc80e61d","ssdeep":"","tlshash":"07212089106397f91817c8f48b680a01822280cfea58c5e5779c52f10ffe15db1afbed","first_seen":"2025-11-14T02:09:21.904187Z","last_seen":"2026-04-08T19:10:30.723093Z","times_seen":30,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/G32DU7XD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/G32DU7XD.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 523\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 753-d7aec4571de4954edae0834ae410f31fa87a7105\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BFqe79FhFC3vcfxtB18%2FlDIIRp3rc89vb2OQ%2Fr0tNmF2iUcz3SgtZFs%2FRlYTMiVfQpur06812OYUPT6m7HYdGjDs0TgQey8AjWhSV09VjihuZQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19bdb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":753,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (715)","md5":"f47d1e93fde4c7d443785cf027578d92","sha1":"d7aec4571de4954edae0834ae410f31fa87a7105","sha256":"d4206aede008b1a8575c3edaa471575e928301cf8e209914107698873251fe5a","sha512":"21131701e7bad427d348d31aa8cf9f5f844b223826fdfd92d3d71d9d6615254b616263cc59a45f197974e5efe7bb0a4375ffcc445a348a41e4a8b6301e0e6026","ssdeep":"","tlshash":"660120bef3a1ad6f2b9d01d5797d804571bcca81584f141cf50d4a6f82106a349e6e30","first_seen":"2025-11-14T02:09:21.938715Z","last_seen":"2026-04-08T19:10:30.727532Z","times_seen":41,"resource_available":true,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/MBXKWPCC.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/MBXKWPCC.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 130864-27504307ca0f9272e7a81fe7777234b874b5ae8c\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z%2BsjtiafzsJ6MfxQibMS4Xk5yk12oidErlEAnZ%2BBI8sm3Nf8nY78YgxHPjET02z6VuQIW%2FNHDDVHgKtMzEPGzTYR1BruTFPoOm1djPB%2FMcmcjg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c7b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":130864,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (7181)","md5":"1218080a2fd189ee4d347620637e7300","sha1":"27504307ca0f9272e7a81fe7777234b874b5ae8c","sha256":"1d97a18aafab9a3adcacdb72190f592265af07b237db21c263b15a3ea47cb28c","sha512":"b97276a36ed8f394caa531e71fbc5213d9d38a80231b9708dc0079c2fe0a371f7e1aa7eabc4c222904b4c9116ac7470852b2516028ce2de2c38cb097d56a44b1","ssdeep":"1536:+f+WqZ/BkK9jNY6NHbOO7fAQj8NqI72zZE6H/lBP2seiH6jMjdp+/j66WwD4uleG:+WWQvHHb7LIyzi6HbP2seiur0AJ8s","tlshash":"9cd32a5e934422760e93c2f2be8a55e0eb7a702d6792414076edc2bc136287dd77b7e0","first_seen":"2025-12-19T23:56:48.589804Z","last_seen":"2026-03-15T23:51:01.075232Z","times_seen":6,"resource_available":true,"data":null}},"time_used":498,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":498,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PTH6S4WK.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/PTH6S4WK.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 472\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 964-672ebfb4945626e018e4b785dc171e6c7b35ec1b\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9%2BMIcGA5ye%2FeUWSIMOAmngQeDOVTn5lS8ugSiU4BcHJTf2foRGWON7xDIE292r9WAmzGShNZm6eEB49oGzjLhR2WeUzZKxr3A25YvEMKem5siQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc098eb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":964,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (926)","md5":"f8523c76fcd6f5bf9ffa8f4a8d1debf0","sha1":"672ebfb4945626e018e4b785dc171e6c7b35ec1b","sha256":"8cfa4df4031f10dd2dc8eef4545725fdeeab6764a85d1ac5991319860d8d7e64","sha512":"9dc7cf28e3230d056d76867ca81510dc5105e68dcfed2ea0db4415f3d381fcce2c31ecda2ad76b2e40936120ece282145b41a0dd46e60cfcf0c92b2dc8111c29","ssdeep":"","tlshash":"ab117d9a32b773f20be344a8b5164647b31657d6a4064099fd38709d33f6fd0913282f","first_seen":"2025-11-09T11:09:19.500929Z","last_seen":"2026-04-08T19:10:30.71611Z","times_seen":31,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/assets/icons/icon_left_brand.svg","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/assets/icons/icon_left_brand.svg HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1992\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 4861-080c614c2235e9f0d51a9a963cb186ec475d81df\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n0B2ubD5oEwmqlYuB76dA%2FpyjgvgsVxmIcseHdTmA%2BjtHFB%2Fx2Wlph1dMZsvvcuK6xYABVVzZkQeQm%2FN7qxLrvKGfrBskIeB3k0MGfkpFexhXw%3D%3D\"}]}\r\ncf-ray: 9b0ad5c15c7eb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4861,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9d297e0f983414f9b08797c392d3c57f","sha1":"080c614c2235e9f0d51a9a963cb186ec475d81df","sha256":"b585ba90024d0ff835b1ac06ae55eda8136ed41230ebd67a03c91e2c68bfde49","sha512":"ae0a9442feac84bfcb73887298f650bcd2ab410a8678fff3e3d4a5c452faa637183324973753df7ee78f7115bde73f75e880ddfa539ffc189b70d555705dc4bd","ssdeep":"96:6UrW/lr3jfDBHYTYm3zGJIkGI4uDzEtofzsuvcQKn:a/lr3BHGi/GI42EB","tlshash":"f5a171375344ab7b88020798e29d81b635d950d0b2bbc1ec8feb74626d02df3c5389a5","first_seen":"2023-12-09T18:46:53Z","last_seen":"2026-04-12T08:58:42.072355Z","times_seen":220,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/assets/fonts/RedHatText/RedHatText-Medium.woff2","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:11.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /if/flow/default-authentication-flow/assets/fonts/RedHatText/RedHatText-Medium.woff2 HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=s82rV071loK2I_eTOn6v0Cs5jNSwEPcK0lidytGtEyM-1766188569-1.2.1.1-wiN46m7HZ1TtOYp7vDAnEmmm09TODYhSg23iSGQmcS2spRD4ZoRHuTgisAZfKfIh6pTA3z1krogY.mQegd13ElTdCOhDsM6zm.GPhuCjwdDbY2le87zN.Vv9au6hhyPpMtU_.k_d4R0uBmTxvRthe4OeSWe.u8ElMlF1.AcGzRUeJyMsz9g4UGHsSZs6trT8YV_.Qp0HvL9SJ0f3u1eMXa1RUh8rWHStTzbm9yQwRbk; authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiIyZDV6Zzh3NG82aW11ODNld25nY3gxeHBvNTVhZ2l1diIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.ASjK_fw1Bbz4A3IrKYiyNtNNqb7ZnwXrNVYVNOvh0H8\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:11 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OGNJ%2Bf6U%2BnHU%2FMkldXRO%2BoH%2FioGTQYnoYrWlHfopc9jREYSMVugLPCfIcmsbt0ZyzDl%2FdA%2FH5LVFq8jThxxRv5sj03VLUA9VyJzGnzolrMKVAA%3D%3D\"}]}\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\ncf-ray: 9b0ad5cccc0ab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29049,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 29049, version 1.0","md5":"13359326c5e04cb7b6abc6d1f4ee112d","sha1":"3abb5b3801ae4e062fe2fc670c2b549813f5491b","sha256":"eb14b0467b18c0fd07810db7ab630a8eeb382353cdde440c7fc4bed3f901ceb0","sha512":"fb96af4c18fb58695ff73380a51f26e31397dfb60f324c379ed276f0ba9601710c95d064dd00e51ea2407401ad25dc285ecb45f9a0b728e34f62713630cf429c","ssdeep":"768:TvJ2ZfL0R5IuVpfhwOgjWn/MtSDT40wpDSP0O4rzqO5L:KL0fVV9hjgAgSH9wpu2z3N","tlshash":"f0d2f22aeacc0b01ffde562e276eb5455faf0235f41a946ee6127013f68196102edcc3","first_seen":"2023-07-17T21:23:44Z","last_seen":"2026-04-12T08:58:42.092773Z","times_seen":520,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/IENAWGHD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/IENAWGHD.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 531\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 942-14ec50e68ff31a56151ecbe848c5554f83f2c850\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bCbRKNS%2BnZZZ5RewiUEWu1aatZyNL%2Bc99Y4KA48AL2%2FJ8aSYYVkmvSNFINXh44oaz%2B7iYIDfibOrQLup%2BjFTRHd5yKS8GLkafG5o4r%2Bj7x%2Fv%2FQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0981b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":942,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"ee1b19e9f6b004e095e25260c45bbfe4","sha1":"14ec50e68ff31a56151ecbe848c5554f83f2c850","sha256":"dd575862985e79725438c6ccbe0adedddaa9d3ed34c7df4d4fa2bc5066af0a36","sha512":"9fff0336c88547aa4fc421d44e3595210d2070881d3be31052b563bba1a0e2ad6d73140ab6afd67f760383db0c80efceeeb711b6042f39180937f76663fb8676","ssdeep":"","tlshash":"0311ef462aebd4f7f327c5f480a6121652215c9b8b648485f2ada7b88f70c51f252a3d","first_seen":"2025-11-09T11:09:19.611495Z","last_seen":"2026-04-08T19:10:30.724108Z","times_seen":31,"resource_available":true,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/GIGOTIVB.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/GIGOTIVB.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 2013\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 5225-290dbcf6205b530d14a8cba9022dde1f1a85afba\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5N3Wz7SjynU525mnHkQeUkkiTscQ2mdFCkyqIUixIntx6p3nxdIWtiFYMLT89gvNTk6xnZqsB4FosDX5FlGH0dtfDVJATLZSRl6hth8yxYynNg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19b8b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5225,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5187)","md5":"56b92a9d6aa7f8ae87dbf24b98dc0358","sha1":"290dbcf6205b530d14a8cba9022dde1f1a85afba","sha256":"54ce6aeee4d300c35b4d168654ef11a6b2a64c874105e94c858248c8fa772f27","sha512":"87f95095134f4e46992ac31028db051689d42cdc9aa3fe45a32a8c15b43e18a208470f01bdffe325ef9c64c96d05d7105a89619e752ce6d68d2b262f1989dfdc","ssdeep":"96:bqrceNDd09PJyYLfX/PVB3+K6TusA0uQ388:bcdqPpbPVl+KquQ3H","tlshash":"14b13fe879d2f57293c3016ac0ef6409f2294899605ca834f3a9edda3935528d2b7f34","first_seen":"2025-12-19T23:56:48.593855Z","last_seen":"2026-03-15T23:51:01.078943Z","times_seen":6,"resource_available":true,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":364,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NDP7CTMW.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/NDP7CTMW.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 764\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1352-8821b43129e00b24e694a2d4c7f14a8ad2e5553d\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lJ8eCjeflOQwM6RtbdsS8nrcbISWdAwCtT8qJd7v0zl%2Fifgqb1Kth%2BxB6JbjGYZwccRf6ItXcNN4KzlA3Fshd6BMHi0lSPEzZy6sGEuUse8w3w%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19bab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1352,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1314)","md5":"fe7cad2ca63ae6c86b6bf413e861a395","sha1":"8821b43129e00b24e694a2d4c7f14a8ad2e5553d","sha256":"0fd471b40f848c86db5b42213c0c44087993ec49f06c26991b494cd8b8f6518a","sha512":"196407bfd5928596ed7ba9a321b83b7acc445e46983dc5862497f07d127c86af0dfbe0b52f0f0b3783d589815a02fa0216e767978e6491317c99abea90d608c2","ssdeep":"","tlshash":"03211edfb4c2b67167ab04e2ce77162273296dcb661d4164a0605c64323096fc37ae9e","first_seen":"2025-12-19T23:56:48.594814Z","last_seen":"2026-03-15T23:51:01.059301Z","times_seen":6,"resource_available":true,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"sso.gsh-services.com/ws/client/","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"172.67.197.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /ws/client/ HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://sso.gsh-services.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: kdsPRREed2p9fgwaIqG1KA==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 \r\nDate: Fri, 19 Dec 2025 23:56:10 GMT\r\nConnection: upgrade\r\nAlt-Svc: h3=\":443\"; ma=86400\r\nSec-Websocket-Accept: tM+xISIp/PfPTamsC7eAuUOWdfU=\r\nSec-Websocket-Extensions: permessage-deflate\r\nUpgrade: WebSocket\r\nVary: Accept-Encoding\r\nX-Powered-By: authentik\r\ncf-cache-status: DYNAMIC\r\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=34%2FNRwCYOULwz3FpoyeOIRsRUragGWBbAH6%2BhwqTqqjIPSdyxRp25KV074YAYrX%2Bqh7YwApoHpQuGlLivMgkFIMrbyJTMxxgUEwR1aMUFJLMqnN36n9TUZYgCYllG4JYd67EZR7hoA%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nNEL: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nServer: cloudflare\r\nCF-RAY: 9b0ad5c15b4c56c3-OSL\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1446\u0026min_rtt=1112\u0026rtt_var=600\u0026sent=5\u0026recv=7\u0026lost=0\u0026retrans=0\u0026sent_bytes=3204\u0026recv_bytes=1308\u0026delivery_rate=3578029\u0026cwnd=253\u0026unsent_bytes=0\u0026cid=6e9e19d544f0b14a\u0026ts=1032\u0026x=0\"\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-12T12:55:59.554947Z","times_seen":13662418,"resource_available":true,"data":null}},"time_used":1035,"timings":{"blocked":0,"dns":0,"connect":1,"send":0,"wait":1025,"receive":0,"ssl":9},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/standalone/loading/index-2025.10.3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/standalone/loading/index-2025.10.3.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:08 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 667\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1533-fa87ad7ca9cdab82f710d816efd0d372898e250f\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lKKnoyO2sFcNveXm6Ed6izZILXqEr3DN4RECAPaWQxPx77X%2FxqnpCvwcC7o2oqODltzwJWdcsB%2BZlzjW%2BgcBuUzDhKZJfPi4bXaR26H3bEHe6g%3D%3D\"}]}\r\ncf-ray: 9b0ad5bad8bcb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1533,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (505)","md5":"7b8e95f14b806da872975c0324a626ff","sha1":"fa87ad7ca9cdab82f710d816efd0d372898e250f","sha256":"9f47d60196ab58bfb7ae792dca6cef49c519d373007bd67c3514d9f1c84cf94e","sha512":"b307560d493d8a31ac15daef65a6891eca0dba7762d84df389dc51dcb0e297a8fcd1b4e8c66720040fa30477324b739a8d1b80b2549da552c9cf4c0af98660f3","ssdeep":"","tlshash":"e3310f0b44f7f5bb0117ccfa809a0f5147406f6be674828871ad16724fb8c82a20f63e","first_seen":"2025-12-19T23:56:48.595821Z","last_seen":"2026-03-15T23:51:01.063611Z","times_seen":6,"resource_available":true,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/2LLLUX4Q.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/2LLLUX4Q.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 359\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 484-faad2a60a7d29d0b032789808445e5d71c090fc0\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QFBFq9Dcyw9Drju1HqASL8EjFv7HYj207%2BfEK2WG7nyP4QpuamIsHxD7gBDvWl7FT9Ypx8Z9UwzHVmg5XYZI1YA4ftp%2BHrk%2F7y79jbkx%2BwxPrA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0984b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":484,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (446)","md5":"cef5c3c72c45beb978d0a0d9937c63af","sha1":"faad2a60a7d29d0b032789808445e5d71c090fc0","sha256":"1c0b6ecfcec5c7b7fc5901483900c80b599629ae64a2c3fa06e84b7d8d0d91ba","sha512":"8a0960f7cca0191f677aae3e3364f2f710a81b3e0668e9f6504aadc816b65c6eb8d23693ddd9e7612c4e2ee9e033e42727c975cfd9acb9e36e43808b112af0e5","ssdeep":"","tlshash":"a3f0dc47f6f382b1420b9eefc2089142c31818b8d36113e4d0ee65a623248d2d37ff0a","first_seen":"2025-11-09T11:09:19.512589Z","last_seen":"2026-04-08T19:10:30.718409Z","times_seen":31,"resource_available":true,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/EJYCJAOX.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/EJYCJAOX.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1322\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 16291-32f8482aad774549a03b866ad8f6b5694d7c8054\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hnaAlASqGrDijn4XOMktV0dDZ4126U9pXHHTAJZ7NAD6ohsQQpjvMnHlpKoHnyG1p%2B%2BcUFX%2BzP%2BMuYec9tKFrF2Z1bkEgDDd%2FXu8MtjGXWnv5w%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc098ab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16291,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"52f21e1ec13dd4725a47c7f0bbd41912","sha1":"32f8482aad774549a03b866ad8f6b5694d7c8054","sha256":"a39c0352ce0fc0077b5db3856d9c16152a27a2324d15fe1ab5cc09a93b454260","sha512":"d6152f14215a966b42bffe0116c84378dff90432130363291bdbfd9f28e2005e55636c6c4b92a8aec34daf9e955acddf770fc4848c9cd1a4fc4dac061300186b","ssdeep":"384:/g9jktf3Yw4Ysq9UCp9hRd19RjwUgwwO9EdWFTUYEUU+9qWtdFlNR9WOHt7fFB9x:T3Yw4Ysq9UCp9hRd19RjwUgwwO9vTUYh","tlshash":"437208010f7e5a707b3fe3399e6a2f49f72c66414919da0096c3361bce6d2750d62ee8","first_seen":"2025-06-24T21:11:18.027735Z","last_seen":"2026-04-10T14:05:59.661846Z","times_seen":229,"resource_available":true,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/OSXVNBF2.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/OSXVNBF2.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 639\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 3055-49d8442aab15cd9e1086bcd201202eeb2c1a412b\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nCbWtbY00BLismGMUyHi25WBT2rfE8oDQ3NAm%2FtOfUaB%2BnE01%2BDGJ0e2X3rLIXyke6clUUFTKG6PFk3h0mWj5OxZq2PsOr6heLRK0fi58AxZfQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc199bb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3055,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"fb019aa73601310849e65da4f1e52260","sha1":"49d8442aab15cd9e1086bcd201202eeb2c1a412b","sha256":"4ceb674824b25e14649b164c44591da0db30d45f8e748974c544f87d5c84c5eb","sha512":"fbd6934086ca12c40c69bf21efeb3c78c33d93f2dde87eea71b90effd99838eb0b3e9de7ee2434c1b13848b684f29d35af7c29edc20af406eaf21d7c50443c1b","ssdeep":"","tlshash":"0951cf40943f48bf66bde77ba14bc6d623ade442cdbccc405ae8036e19b23ed51121b5","first_seen":"2025-06-24T21:11:18.018275Z","last_seen":"2026-04-10T14:05:59.684036Z","times_seen":228,"resource_available":true,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/OGLYICC3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/OGLYICC3.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 643\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1181-b01ce77218d0f2746b048eb6d47a2bb7b383542d\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zE9sawVKTyWv4xYHS9qm7w76M5J0EzvvpQ%2B3LRusjj6AO1LbFjDynZtFZbQfa46wrWRLGbfoGqTjfGuvSTCAMlS0ro9z6u3fSYHmG7qbjdiOqA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc199ab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1181,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1143)","md5":"c273aec6a0f9e322ebd7385fccb9c94d","sha1":"b01ce77218d0f2746b048eb6d47a2bb7b383542d","sha256":"87c408ca44b2fc3bd9c7371f36110578a835fd8fd4794a6c9cf01594a3c8ae65","sha512":"73108a0a385d7f8891df0f7f23a829abf4b8fe58bdc921df0ed97cfdcbd0d189824cfc3aafaab67aedae1d9f3920edc4c13569a26e7491e089fbc4a0f581ac62","ssdeep":"","tlshash":"f321df556ef0a0f54396c0b7ad31c00f930074d4250940acb54679fbd968ec6e2e4fb2","first_seen":"2025-11-14T02:09:21.914233Z","last_seen":"2026-04-08T19:10:30.710293Z","times_seen":30,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PE4KRF7A.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.988Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/PE4KRF7A.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 16713-3f19f2b0fc2fc23310816268c8ab341032d52260\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yAC8OXrDpXFcofxyaGCH5zeZDy2KZeV%2F4nDb8A02Bvmk%2BS%2BPJVUdcsSStU%2F4735%2BCQSY1Ca9gvfYCRNkRT%2B2ydvBbZywcqEx5ov5VqwE7Rm%2F2Q%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19bbb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16713,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (16675)","md5":"d7306a07cb6669e2f11b5d3f8ee0668d","sha1":"3f19f2b0fc2fc23310816268c8ab341032d52260","sha256":"16e6ac7b81600a1b366bc09b03ae560ca25422b3e1f95ab7272a41529a7cdab1","sha512":"e90d0d1aef125c8fd1b0ccc333a76de56807154a9233e7910af3d4f114ed17a62f651fd44babd57d41108078281986b084dc7ab37c432f132fea1a4e3858afc9","ssdeep":"384:AtKt2G141nNNnkDrdatDbSjfb7dvfmgPT9MhZ/V:ft2G141nNNkDrUtDSb7dvfVPT2Z/V","tlshash":"f67272d573e2b631439b4765a07a4007f77e5dc0510e9228fa2dc8ee3aa8455b2b3f78","first_seen":"2025-12-19T23:56:48.600429Z","last_seen":"2026-03-15T23:51:01.08909Z","times_seen":6,"resource_available":true,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/6HFXHYTL.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/6HFXHYTL.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 17628-41015e3915613814ad26b43913bfa6eebdbe738c\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nKER%2Fo5nPkCFQAP2tRO6xk9%2FM2JhdN1i5pZSyIvU6zUaNN5kOslqF%2B9nY09g64t7Cnp%2B9vBoy90TI9kLlrUZdUuxyJ0h64xPBAIU4RELLDU%2B%2Fw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf96cb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17628,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2666)","md5":"8bd6f66abff433364b66096ae2599027","sha1":"41015e3915613814ad26b43913bfa6eebdbe738c","sha256":"79d0aae52b30c7dacf99a69e67bf30f86ed17b2c911e537766a59f49b20bd8d2","sha512":"43c4c6ae396ae4367d4055237b5e70e90cf9bb43bf7a1a5ca454880d2e7e3600b9cd800a078231a711aa33c13c7a2cc8f7c51f599401719595ba666dea8a4ac4","ssdeep":"192:dUvcViJFDbxOoU8NpMU0/w//Lbek8HQyCd:EcVcFon+pr","tlshash":"f982941522a358b70ba1c3b1a56006223670d00bd51c94fc7bbd9bfa1f76d829527f3e","first_seen":"2025-11-09T11:09:19.473201Z","last_seen":"2026-04-08T19:10:30.720008Z","times_seen":31,"resource_available":true,"data":null}},"time_used":462,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":462,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/II2J7NHT.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/II2J7NHT.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 576\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1115-d915b85d3154a1922274a4c5d956bdb02e174015\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wP04IjA0LtJgAme9hNhVd8I9rKL583n6v6vF6tIN43MrThPcRdTGIzmDF3YbXUO9N3xKd2dDXbp8q2FB3ffCqQu%2B6nAN%2FO8r1hPo8f%2BXKusgnQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf96db4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1115,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (553)","md5":"c6920ab5e9797620ffaf5edd0d4881b4","sha1":"d915b85d3154a1922274a4c5d956bdb02e174015","sha256":"77192f7488986402e1086db6f38b4d7575cde681453cc515767c5f76fe9f6dbf","sha512":"57e16274cc7c10a49f6fd6c2988f30d221431cf67f1f188678fcaeb35d32c3104b6873a8f62e89389ab42c3a32063df013edd6a941e023e7df11f5f76cd7cfe1","ssdeep":"","tlshash":"8d21b10a5165c4f60a1f4be9d1a51373823024dd8348a1f8b1fe0aa21f60d51a15ffff","first_seen":"2025-11-09T11:09:19.418716Z","last_seen":"2026-04-08T19:10:30.712912Z","times_seen":31,"resource_available":true,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/GOLPYOWD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/GOLPYOWD.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 417\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 861-4f81c3c7ea05ecc10c544c626af9aa955e9b4f2a\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=reJ5DivJNTGlnOeckroFQbgg%2FUih4KcXuNc0pEkZyQR8sfm29bGR7WEmzj55%2BslaKwU5wI%2FlEY7ouwWO1ZyNjoelph0Q1DzH1ln1gMW1Vfp7PQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf975b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":861,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"04440f71e1831382763f7c4ebbfcb900","sha1":"4f81c3c7ea05ecc10c544c626af9aa955e9b4f2a","sha256":"f9008711a225ceafa29e34833cfb357c74cdd0dfc049391f1319388c5b47bc99","sha512":"848cb653bcb4dc3383d653d07deb9dd6335af67da94fa46dfbc6536e0f3856d4f5e0750f3bed40a0eb2433badef83450f941e5c5a344477aadde9c3909182277","ssdeep":"","tlshash":"e611dd8e40e710b0890bbcffcad71140a250905bc74dd950b4ee33d1ef2be5a9a82a74","first_seen":"2025-11-09T11:09:19.432174Z","last_seen":"2026-04-08T19:10:30.73631Z","times_seen":31,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/YJUVDCXF.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/YJUVDCXF.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 221\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 279-4262ed8c5bb17b28b1d067bee49b9531b1d9fb1d\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FpYbsdtJx2Tciwt2KQFf%2BFvpF%2BfsanIPk58Olh1JuU9U9C4MgqvXzRf7dQOvIPDxwa3gGmIqPLzS8tMBGyysGzXUgmw%2B1ouveExC363GkSytAQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc097ab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":279,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text","md5":"5e01e6fd314d20f9433204b4e0f0d136","sha1":"4262ed8c5bb17b28b1d067bee49b9531b1d9fb1d","sha256":"d7ffe23d4cb2930ab244cdc7f49465766deed348e669fea280e7af84f2779fa8","sha512":"ba0ec8253f352f749122f4896e47f2a2e74aee901e64c756d0c4a703ce57876071bdd85c48ea1b22b85b240e67e9de3bfc660abefe9a5902d3d93b01aad578d2","ssdeep":"","tlshash":"f5d0c29d60ead6b4a1e35cac210d0e83e1ada025eacc2e90b01ad21543f8490e43ba94","first_seen":"2025-11-09T11:09:19.43664Z","last_seen":"2026-04-08T19:10:30.726535Z","times_seen":42,"resource_available":true,"data":null}},"time_used":147,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":147,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/LXS4CBUS.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/LXS4CBUS.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1392\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 5340-25dc28da036934a434d4fde309946f19983fe03e\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YwKMfs%2FD4HFsStTvY%2FSw6J3yEYy5R6NxiInvDanDCbKnXgQMN8iEL41jyLrsa6ViX%2FDha4k%2FWTX%2F2Nplx%2BZEz2ZVGXDoHEDKsdadg6LUrRggfA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19aeb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5340,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (584)","md5":"287a77384d25f42e19a025e509db5b97","sha1":"25dc28da036934a434d4fde309946f19983fe03e","sha256":"fc3a47d7004da5f25f21836e753b994b3c72fc519778a73202560630a7f798de","sha512":"cfd3b8353f2f85b42e62a2c72fccbcbe8dbe9280001e0276d78ff2952ed56f3b160fa71070110cc727c4bf1d79adcbe2be6fd5cda6d1ae7c8a1d074f089a5686","ssdeep":"96:lzljBL6kBfRhBPw+xAdjjNjr8KsY2KJbY1lMyY086iYEMpdYXjlNYn7AC/eerLR3:lhFJx/eOYduQI","tlshash":"6cb17a11187fd0b54f3debb6a35b1b89ea7a584b5cc8c099f68c4a224fe077872117b4","first_seen":"2025-11-14T02:09:21.98971Z","last_seen":"2026-04-08T19:10:30.725082Z","times_seen":30,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/A34YZ56X.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/A34YZ56X.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 914\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 6349-a55f9c40876755ef853a93c6e0935ad4475373be\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CWvICSuaPWCaxcf6tn3goI7VESgdROF6iuaYAmsRewv05kdKt3YrxVQzgjVy9yZrN%2FBgWfsVYvFAuOrJz7ShBYjyw4MLTvRyZEShUcsE0IeL8w%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c4b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6349,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"2d2f6ed0dccf3df931d6af9b6f068ea7","sha1":"a55f9c40876755ef853a93c6e0935ad4475373be","sha256":"f81acc8374628f7385315d91b6e7c81c12dbe5ccf53ad78a60d742dc10cfa29a","sha512":"faa848b6ee07a1348de537e0a7af8e82705e72ac9fc652c4ec71f8364406a274a7a472078af8e9994ce1d97f308112634bf364328592bfbdd7af1aacd6c6e15b","ssdeep":"96:joA6EpTkQ+YaZCD8iURCQEJahfM5CEhmDnGhfgLT4c4OkGkK8b4gh:OQ+mQeK8bx","tlshash":"fad15e40063a827dad3ffb76916f676ad3ac1cc44c49dc4c54dc02964ae93b9931e2f5","first_seen":"2025-06-24T21:11:18.04598Z","last_seen":"2026-04-08T19:10:30.715139Z","times_seen":215,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/api/v3/core/brands/current/","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /api/v3/core/brands/current/ HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nX-authentik-CSRF: \r\nbaggage: \r\nsentry-trace: \r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:11 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 258\r\nallow: GET, HEAD, OPTIONS\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-language: en\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\nvary: Accept-Encoding, Accept-Language, Cookie\r\nx-authentik-id: 60b4acc98d6543908c63137dec528544\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: authentik\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x%2FZFuu1Fv5nwZBv0g5TYmF%2F1bmRJFYgrvRxq5kvzphx8KrpcYDhOOmVJAbGBXtWPuZ4uKNN28D7OUVZS%2BC%2FQQWOgKBDp%2Bl0e46kIt7tXeYtJvQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5c17c90b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":503,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"bb9233db971e5a156c4925cb592193d0","sha1":"26eadf6018dc728139674c4fd4dcd2c7c1004781","sha256":"03373e1acffbfb6014691ff274592447b53be97d689f92ab5f4a4e6b71bd7e39","sha512":"5e5926d44e82373c158254ad9bc18357d1d2f1e81809eb206425d2224e3d85f865c0f74bbb32a121bdce941d8edc91e06a8df4de02a88512b9e3573925812817","ssdeep":"","tlshash":"c5f09e157918540b8bd817bec5ca1f22c1fb194c2de0784cd0bd083446f8dda924b7d9","first_seen":"2025-12-19T23:56:48.607791Z","last_seen":"2026-03-15T23:51:01.080064Z","times_seen":11,"resource_available":false,"data":null}},"time_used":1191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/poly-2025.10.3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/poly-2025.10.3.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 505013-6c2d97008d5918ddb2405744f253f5c6a768c76c\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YC2La3N4%2BIFX8MekUj29LJ3DG5BDOTRZKKK2%2FnsvVAkQ%2BNWGzNvh9N0HfgvRXsO1pE6OXUYxjuZ%2F0ZXeAKiG1D8u8BCEUrTEQu7ngPQkn7lvtw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bad8bbb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":505013,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"data","md5":"375b20e01a94943cec088892771512b8","sha1":"6c2d97008d5918ddb2405744f253f5c6a768c76c","sha256":"8c959ea6a87e00b120216ee8edeb8df5b68efb2673d8c776c0f3248e7ad0783e","sha512":"4352fd6790f9ab848093d8ada7427bfad6237fe2e2d8d876be9b53529d0afe9d2ac48e4af809de9e6c653c6d48de89f6dc12508fee4dac1ebd66a30984606504","ssdeep":"6144:Lq6BgBFrKQEkaa7dczDbE4l574lyAW91MbvJluqlKr/JsIdHDP:e6BuKQb5dA1jAmndHDP","tlshash":"5eb419cd77a2b4a547e760e4143f5447f33729a0940cc069e6d9dce538b8e0e81baeb9","first_seen":"2025-12-19T23:56:48.608647Z","last_seen":"2026-03-15T23:51:00.98227Z","times_seen":6,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/assets/fonts/RedHatText/RedHatText-Regular.woff2","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /if/flow/default-authentication-flow/assets/fonts/RedHatText/RedHatText-Regular.woff2 HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Lur2WTtRVOALxpNFse7E3EUzxW9Gr6q%2FqmbeN%2F64ELgYRwFaAq40TBYpGRrQF%2FgLiy%2FWBVTEPrNmoOGrynThzlIeZCwILUD5bJWaTr9QWBZ9OA%3D%3D\"}]}\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\ncf-ray: 9b0ad5c17c96b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28169,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28169, version 1.0","md5":"75752e720d252b378f1baca698580433","sha1":"cf18fd7718194d29d92673b3b6b4fc494730d0b3","sha256":"542423d086114efc78287af567bfc3124c2d87022cbbc16fde1241e01f97757f","sha512":"bda1f752d9fdc9fc810a9cfe27f377d553f093ca2ef3706c4189254be66323f1bf655414f5c3dda93ff7c4d337fd4219f514537b3675b79a980ba2ef88603bff","ssdeep":"768:lxqD1z+k+xV2lFm4OZ4gR2x2iFhxROKH7:vqcVxgfgR2x2iDqg7","tlshash":"e6c2e259245bb7bcba491c85c431d386afe214251798fd60fa363f79c01c73a8d8b936","first_seen":"2023-07-17T21:23:44Z","last_seen":"2026-04-12T08:58:42.07852Z","times_seen":425,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":133,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/DF5VMGPU.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/DF5VMGPU.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 789\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1416-750582ee6474b307f966d516e95dd1b9aa33a6cc\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RraqgH9KitF8GC72pUtOGJOWFY5nT9t1Qh61ZdHFW%2FLH7jfps48co34azT2yRogbz%2FXnd8Gcndm4Els%2FnMSGcGo%2FCUfP21zLTuJ%2B96NDp6YK%2Bw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc097cb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1416,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1378)","md5":"bc8b311e7ecebe87700b38b51b4c3c42","sha1":"750582ee6474b307f966d516e95dd1b9aa33a6cc","sha256":"a2cc76856009ddba693bb722547bd4ffe25ac5051e4fd1aa098d87f0067493ea","sha512":"73992bc199f4dfb4726cb17cf1b4d98364182d64fbeaa20d44aa253c09af21737e7c4dd0468e2a9d1c6099abe3d13cbc54c966dc50445e0fc801f77c3610cb2c","ssdeep":"","tlshash":"7f2135f96b9732bacbce2468d920150a918c4b2caf58114ab670287319c4880ebf5e98","first_seen":"2025-12-19T23:56:48.610038Z","last_seen":"2026-03-15T23:51:01.057569Z","times_seen":6,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/7Y4MCTMH.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/7Y4MCTMH.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 764\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1570-b67c18b22f8a5e977f34ee46c0b81b7d56cf3790\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nj%2FMrmvf5fnpvkGhngBhxHye9QZfFEyRkXOpfm%2FtMYoifWMvRCudGElL0hIlLSJgdX6fJGtiwmOjY2zwGK510jz8B6fbekWcXS8YwmAX8CeHEw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0988b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1570,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1532)","md5":"87aecadfb57ff305cfd0b55b25d2b337","sha1":"b67c18b22f8a5e977f34ee46c0b81b7d56cf3790","sha256":"bf496605817280d28ab543d2e6cefc91ea9889e4684d54138b5b175b34b7d591","sha512":"35dc94950089e205b24e63b9fe61dcf833bdec11a340964495f19ea0a0cec0ff5422368b1eddd0d0e29ffed32e2e3a214393e8a510e5001714c0654cb644ff26","ssdeep":"","tlshash":"33315352b5d1ab34bef385515a976223b30019d0475042a97534acf4e62a8c0f1bf7f6","first_seen":"2025-12-19T23:56:48.611108Z","last_seen":"2026-03-15T23:51:01.022456Z","times_seen":6,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/Q56UXRL5.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/Q56UXRL5.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 142\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 123-3023ee2c3434f9c70d49731cbf9ef4a76d6dc917\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fZdxUwbb%2Fydg19EPkDkTSQuK07DidsW6EOvnyXuLr2Dr9WmAG1Y0mUP2Ql9LAfZd3wzrhmcqENOf5I6PgTdWVUPCf0B9glXPmPZ8j9kMHuGk%2BQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0990b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":123,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"fff9801ed622b1662fc4f490b7fe057d","sha1":"3023ee2c3434f9c70d49731cbf9ef4a76d6dc917","sha256":"eefff7a74b70562317c4f546f370ee2d6a38b6fb3b693545c68b9d816c1876f2","sha512":"0682fd6d8b8b1529fc14b6246be4112c72f8720d418423d849bb0dd2b14e7ee21acea6d7b01841a8efb4feace5394139eddad4f30d0e5d2b37004f0ebef20526","ssdeep":"","tlshash":"2fb02b8f9b3c38f68c3b052f000b40c8154001cc76000108a20305534031a834440ce0","first_seen":"2025-11-09T11:09:19.583389Z","last_seen":"2026-04-08T19:10:30.740221Z","times_seen":46,"resource_available":true,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/MWPG2FFZ.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.981Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/MWPG2FFZ.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 22298-0365a7f5210261c957a3467b26c9bb1dfe2e7486\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RFebPYXvWmnC4jsFXujEz465CVTez98Ln7ThQKDnCe96dY60NrtQZEWSerdQnIakAa2gk8KtwATYxfL8%2FY13hoZNvgfnAVICiPWLsvXskoqkHA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc1998b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22298,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (21702)","md5":"88836f516f19229475990e81d97d288a","sha1":"0365a7f5210261c957a3467b26c9bb1dfe2e7486","sha256":"09cbb0805d716861487f6a45a048309f50ab67367e916762928b893226dbc94f","sha512":"d8609c46e3dcd358fc77ec4499f0a4b909d5a79d7d60fa632cb861aa4f93df94f8b92b78dd26e8eeb995a284abf880b33492bb3ebbcc4980f6b2b26dbc4a65f5","ssdeep":"384:S2L2Zv0rOZj8RjieMbMIhuzxHi5DE90Eff8BaFcq9SI0iRnZ32g8/5I:zL2er+j87Mb3huzxHGYaEfoaFcnVi9NF","tlshash":"eea22bad7d457db79fde41d8607b5a0c95bc100ab00c8460e2ceddb518bab98606bf2f","first_seen":"2025-11-14T02:09:21.933423Z","last_seen":"2026-04-08T19:10:30.743727Z","times_seen":41,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/KBWPKQNA.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/KBWPKQNA.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 781\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1448-a6d7d79be06ce67dfff4a87cce87a795b9156c23\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UuGrJ6NhNtJsra%2FDiPbexUSJBaHg5W2%2Fge66w3889n8sEoGc5Erp04e5DeXKUZwCuSK2JIpXXfXgEFwmojBT5a4r92Z5Qg0XMl7pAFaIeMNRyA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c9b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1448,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1410)","md5":"0a31185a65e81cb4f47b34dedbdc909b","sha1":"a6d7d79be06ce67dfff4a87cce87a795b9156c23","sha256":"3733f7a83eebff1f96afa552548c60d32a0d69c1cd8f2cb42531c6d6a05206dd","sha512":"427cb8ef420d1471f5d70f935cab8d4374231bbbaf3bc89393b09aed305ab30a828496d3a6edc21b30235062989861ba475ebcf158dc14fe44a00adb93f0b1a4","ssdeep":"","tlshash":"8431228936e8a673417459a6c63e024a750ce4bab1fce8b05300c6a5b1c00a320eff3b","first_seen":"2025-11-09T11:09:19.458921Z","last_seen":"2026-04-08T19:10:30.718979Z","times_seen":46,"resource_available":true,"data":null}},"time_used":397,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":397,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/assets/fonts/RedHatDisplay/RedHatDisplay-Medium.woff2","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /if/flow/default-authentication-flow/assets/fonts/RedHatDisplay/RedHatDisplay-Medium.woff2 HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:10 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wYP3YOweZDdSdfnRKTgG7p63HPaDdDVSIIJ%2FcoG6ON2%2FiB90rjcExsUvGl8vfh9y3bNjuxBV6ikkJhvvA9itEp%2F78LpzEemrYlGVaxHKDht46w%3D%3D\"}]}\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\ncf-ray: 9b0ad5c18c98b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28661,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28661, version 1.0","md5":"17a79d9dab357ebf36e5f0506202da76","sha1":"f658def655b088357f179e9176af8cf18e9f405d","sha256":"6d3ccc0f1407d9ff46ec4f88534a49f866b738fe8c944e704cc1eb42facd9932","sha512":"5de010c10753641ba097f8087f2696c425ee8b40363eec2e9f152d53a8efe355ac6f639da1193353d54f78fb426e28e7b56f380875ba26228ec9e355f005a62f","ssdeep":"768:3/Yiuy9hrenbTNAjfa5t9DVYclZUCOM/wWAJcu:PYHyrr6paa5bDV5lrbuJZ","tlshash":"91d2023199d1bc4d0a02f46c68bf56c529edd246a5f1ae8d34cda1f0db36b0613c1c55","first_seen":"2023-07-17T21:23:44Z","last_seen":"2026-04-12T08:58:42.096205Z","times_seen":415,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/authentik.css","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/authentik.css HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:08 GMT\r\ncontent-type: text/css; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 16786-7fb976caa59c8189daafb93498df03ab3be8f7b4\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RceoU49XSuKYPtGDUa4WAaJcEZFD3WelQPwfmQ8ZtMCC4o566FXEMALFcw%2B7fGw1k18S29vRfGPK98qDIlchvgKK80O23oPwLXl%2BJUTLGNN0VQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bad8b9b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16786,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1911)","md5":"e986014965f393636d49077700ddde6e","sha1":"7fb976caa59c8189daafb93498df03ab3be8f7b4","sha256":"27aaf9faaa1b474d06e4a08e11652d3da4ac1d8300c258b7a0552e0e7a3c2093","sha512":"c01a87b7b7c6039b086114d74b21f04cab6e40ccdeeb0f75e2eec6be75076a1a85ec61f08c7488f1b845ac8ece4e7f7f1aaafec5550d48f3216b41d9491417b0","ssdeep":"192:GukhTPUhCXjkjeImbxWVHD4V+B6Y5V3tqzP0p9NDv4FiTkBqlQTf/cjsDpcyQCUy:GugSIqe1gkXYbPpPv4Fi1yjTRznya","tlshash":"ef729350a4f311b6643fe77da3ef920633ad6143851cdd90baed57610f893fc2212a86","first_seen":"2025-11-09T11:09:19.456414Z","last_seen":"2026-04-08T19:10:30.742545Z","times_seen":42,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/S7ISSYSE.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/S7ISSYSE.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 12066-664c5375f34eecd10366e51f31275a813677376c\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GxCkq4YeJKAet5sswRxx8FqWbXW6RqUh3cRLsIn8q9twTXXdYdMiHprE9k2RjwCx7h%2FSSy7YXpEipTTEPS0CV1WK4f4ZloajMSwqdjMup%2FIS5g%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf971b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12066,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2974)","md5":"656a8993909de6e768d5b4b5216e942a","sha1":"664c5375f34eecd10366e51f31275a813677376c","sha256":"a020dd8f32e732accacc9088d68acb7911974520056fc3f07a1efa16975e91ec","sha512":"9753eecd9e57fd25890b161af4675e388f48f3c00bc7020bf8c250b4b53024834e32b4ad9a579d0be8cfd1fdddf7ecd7e1194d4510241888ebbafbed7b5b9661","ssdeep":"192:Vq2c9cMWqpIHrW8rpy6DztNG/StZWnAJLaE1OfNsFOnCM:M2c9cXLTrgCxkqKSaEO3","tlshash":"7342c71586b351742e2b46aa961a13c15725a0c7f00c95fd72ecb2f85fec8d5813af39","first_seen":"2025-11-25T05:22:16.006675Z","last_seen":"2026-04-06T09:43:18.652006Z","times_seen":19,"resource_available":true,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/W7G6YGXJ.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/W7G6YGXJ.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 214\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 224-b83bb36a8a692a25bf6dbf9902c702c22679cb83\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wUk9lCuc3t5%2B2h8cXp4CktP3BpHruiCeiK0KL8lI5K2y7pLNDheLEgxG2MpYLG5W8CTHwqwrDDc%2FSrCOJFhmf4LwSMqZw0N0Pmjw3jF5oO8YDA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0980b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":224,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"19aebc536eac026a61665b1f751bddd3","sha1":"b83bb36a8a692a25bf6dbf9902c702c22679cb83","sha256":"8252add7de4cd67547afbe5911b0f753665164d47638e5a0eaac932f9980912b","sha512":"c7cdfa73748a3c39b1d57f96a2d6f142a2010da227a55e67de06e62e66fb0673efd3614d57271fcf33ae60f5e3c6565a813a5366bffabf3ca210ec0d6de30d1e","ssdeep":"","tlshash":"dad0a76c77e0a9b7f205812941fb9016911cf1d154450689f041294578a8d48d96af58","first_seen":"2025-11-09T11:09:19.497888Z","last_seen":"2026-04-08T19:10:30.745351Z","times_seen":42,"resource_available":true,"data":null}},"time_used":413,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":413,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/X7XBOUB2.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/X7XBOUB2.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 415\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 673-b01e5df1b29348b32319b210bad8bd2713eccbc4\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WIROToll5irbIsUZo37sC8XtefMTtgcBMWuP%2BX7IKP4rtDi71Shv%2BLVwx5RaUvFQoBTXP9zzLY3bh3tuVqvyZUyq183zeNILe6vNMcNw%2Bn1A%2FQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc1994b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":673,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (635)","md5":"c02d15cd7ce264e3f509fe6e078cadd9","sha1":"b01e5df1b29348b32319b210bad8bd2713eccbc4","sha256":"b4dcce380f54da36b0652484a1aabeef6f6ae87e25bcd6a6824d81dae0f30ddb","sha512":"4c5df56fd6e42f50cd6aab572e7104b77d37e4fcc76fd088aa26cb5fc61b36511af2ef736744b36dfd1d01943f8edc331a65271322f77609d23beabef2708249","ssdeep":"","tlshash":"79017b6f75e8e1b04ae984910b158583b10530e1a1fcc0fcb2bc40ba39a8a46b17d235","first_seen":"2025-11-09T11:09:19.641818Z","last_seen":"2026-04-08T19:10:30.706298Z","times_seen":42,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/assets/images/flow_background.jpg","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/assets/images/flow_background.jpg HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:10 GMT\r\ncontent-type: image/jpeg\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 916394-15f789e2d26b26056d8be5508f858a9a59f95a60\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GtEtcmYfB5%2BPH0LZMRADm5K5iZpOazZV0LMgIjKk9MmiZyK811QDkSVvq5RKtqnpQ4YCTnaVRv6ixES3PFEArnioFDZPhXV6K0bs5fH4mViflQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5c17c8cb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":916394,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 2563x1440, components 3","md5":"70b34f093c0b383f47aec03fa24347c4","sha1":"15f789e2d26b26056d8be5508f858a9a59f95a60","sha256":"188c3baaebe7b6c8b5a0111bfc56348fff353e4141dcbe154be498c4e183fb5a","sha512":"1477c3f42d9a7d2ba198e51f816785a691d1ebbd2320f5d656d3bf492f714a171835161561d1d32972c174ce4d2f5c29627d38f9a6f19e8b033fe247d8662600","ssdeep":"24576:Ssp4Y7WjI1T9+b5p3QlgCOG/rWULAfSGIyY:QyWjypAslgCOK0Z0","tlshash":"84152377c2130cffd63e457a875a296e29665c5eede012ae03856f1bb34ab63c08c5c1","first_seen":"2025-11-14T02:09:21.956187Z","last_seen":"2026-04-06T09:43:18.610269Z","times_seen":22,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-length: 0\r\ncf-ray: 9b0ad5c19ca7b4ed-OSL\r\nlocation: /cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=ID4GRtt8iGKZRo36IFbjbF1kV5XcBfzrWIbQJWUNJRq4NiXcCiSSYlkLYsL9jnS6z1K5R8XvrKOzXN%2Ft2mCkeR4rGcSfu2N1dbkTPmQvhoZ7%2B%2BUd4EKQDENJqsILdgNXkq6R6KB8cA%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1462\u0026min_rtt=880\u0026rtt_var=187\u0026sent=701\u0026recv=374\u0026lost=0\u0026retrans=1\u0026sent_bytes=641693\u0026recv_bytes=8848\u0026delivery_rate=50366863\u0026cwnd=256\u0026unsent_bytes=0\u0026cid=51aedaa60604b1d2\u0026ts=2158\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10329,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-12T12:55:59.554947Z","times_seen":13662418,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/d39f91d70ce1/0.3780451687312639:1766186144:EobRTfwr6Xu7I3R8c6KRrF7bVsaR6eNKDYOjvywon50/9b0ad5b81ef8b4ed","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/g/jsd/oneshot/d39f91d70ce1/0.3780451687312639:1766186144:EobRTfwr6Xu7I3R8c6KRrF7bVsaR6eNKDYOjvywon50/9b0ad5b81ef8b4ed HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 12229\r\nOrigin: https://sso.gsh-services.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":12229,"data":"xPTH7U$wEhze$e9y53mISVTzDHzu5e5gQ+5DREh$V5Xi+gxnTze$L+8sH$R+ey5isLHzN5sMqop5CnqXp5+qUH5zI5zK1+sRzBuaNMzwBC+uDz2vNYGd8jW5$Tj-Jc$$ME5Mys23w5zfkpJUQZ56O4aQQ-T$316HEK5K0$wJ+0Tl+MTty5hUO4FS3SC552lOiABSLZYyJKECH5btD5fHEp0Uu5qLXhnp$xY0d+vu0I9oF1vLH5e2D58gkMsVxiPkR5o5vitoC-Z55QlTSHDU55-jjDKU$qTH$-vNPUZ9MiTLH5p20HvOCAw-e9bMw8T5QQP+DxC0H5zExEusD$yNqyNByT5wes56LymT5+X$cvJ1OEhT52BjhXj9UIN2nU2kD-UefjJtkusikKEuwXDfjijH5+if5+5DJQMDZLD5DBC1Cj4upw5Ep1CQoUKfpFsi209-fiJ-U5NTEm55SWIAn3GBM-TOty57OKufjMKQeSn-oLBfKlCoUKpQ0UxYCAuiBD5M+7SYTWsqFmkf+$ypv$ZlM7IAUNHGfyBFHWfdt6RXNu9NIRlOdEJcuasBHitkPnuRdopXmggWU-B3zNm7Cofo3s$bf$ABWVnujBukJbkk5CmbC+ybdQmmPTUO22zXx9t-HQmHAWXHw8MCUZR71ACkE-0c9d48+uZy2xHZGldI9P$-NQP2V8PHx5OYaUNNPWl2fYCgZWt4lUkyO+BSta-yFiPQDW$q55VWWTWRmRVjsTDyR+STJAgBNBtWj2LCC6eQ72GZN2oO1hQb$FLDRG-pUEmA9PkF5OHN+P7jVyQqE8-y5mBNulWA+BA7fNPhUU$su$l6yaEsT0tRP5R08AFsBjATTOW0NPl$h8RvE+5k5015kg$0ORWz85+l$EF5kRU+TDWOO-Nz-IRu$+pTyOvxE-mHQh+QmQTPJ0ayD0HOkVRUNP6qJslA0Ry3b5U8Tg0HxT5f9x41i1fTvEm6yCD0KsbJs$IktmCHyMExRiDU5nYsZSnTHb0smRZ+xepPzn+MjuxNzOfU1pmxD-ERtD1JEuXMsD2xsRbomWHZXb6Hbaecl00nfJl6WHmTGynEw8TvMPpbJMh8TsfJp9cisT3ICt$4afx$DBd9D5jbD6lHQkwHDjEHUPNDtz-FRHfh+4-ED9ze6RPjZUjQzPNUmRv$YOlC50yDt$DGyDs+14$x+94GqmZClN9SRlE+F5y7+1iZjmNtxswNt35cJ5M0+qT5lsVIW$UnEmb-NmVpEuDoqEI7THusLOU2VHZWPdzkq6IPu$MsjTEI59L0Y++kLwF5JilFPuE+7eTJj8ThTqhuBgt8eOlqFE+sTLbgBKEuNNDmnuX$d5Tof18qLw+T+WH8eEffCHk2sxPFbh6y1T6ayAOa1DEwH+XLgK6yanKQEwqNq5fx1hDN$KPDCEE+v6hPQQJWKQhJH6Xv71xiLRcX4RDCjiHan4EuBW6x631p5U4M7d-F37dpst7AQMIpxQnzWFfpGT8G3Nbp5S78FaZZfkLR8gnTZjfRUj9vcypGTsclZGd5v4aMR$FFDvR5+fvkh5dDu$P5NWcUcFZgeQuYjm85iNCHluRxDp5JdJHcAuh5oH9$FwDzVE48hpZtHxueIB5vXQsDEPBR5FLw$+IWaDg0O5xEy7L85lzp5ezyaysWQkmAlDjTuDDgsFKJ0LmgSdIE2Fide+To+t$ITPEC-TRBHl+U+I+O5VP-j0$Qvkz3TQFPYLF54IRs2bR7QvFv2ksM$+XRU+wa4oQLj8F3CSeuuWE4GIpW4SSK+ZHVzIFBxmNR9bwzHmWQ+g5PCTlPjjg+2+MzQLXpfmmVTgDO$hzpDmm5NChBm+QwDiyjEjpoERgYxN+Okl0$qws+DwRR$VRn-s2T20w$VXIxDQ2l5a+DWO-gQTGWTg075OR6A1x6OWTUom6+xlkL2sTOT7tZWUjmqu+T7pbmQPKiejHauOHFWORAtSQQ0sp2o8RImJNwUIgONP8wCSUCIm0gSHko3T5upxjWxD$+fDxyU5ZTbs2tp5zpTWO$00qoQNQusFlIx4hofDowfTZs-fg+3OW9g6p1E+wHyHXSlMqfu6sQ7UFs6T+KYTlnJBwMjGyNBMxFSj6kzEodkO2LE+-2D6KT9QgX6p74ny1OtC+y5IKLQQ-is2+iwmBz3an+1ciFqHL-D4A-6laF2DZS+PAixagYdX0W6uM2QS00O80zEtQ-XfOxHUCyx$E$680QP9WXpds6fJtf7DvL2gNkhIyNNiqll4ey7fKlsD0XcDqL4dJu7OVV0VHhvPgLYW$-EfPkJNq9mB5j+EjQ87udeL5hVT0H2+pi7$Ghg50yQuU5m8TDZlKeyP8l1CTTDYzj88zuKtSA0$fEIZYpZlytpk0fKItXlFYQEB8SUR+SJYpyK2ZDUuATi$Qhh+6J4IDhD5aFQEAh5RWbghFC-iNxXCMkUztom0WSlJmcMlKeyx0yOSDgmY4m9hOCmB8ReusbgYqVsz3bzoSCmcHg7Q+XT17Q-kZeOeC+DkMQEj67CHzolmR50HnBV+D1Vw58yWaysRt5TtvOeuDxof7wOH+N$n+BDKNIwN474ioZF+Kl0IpkbtiFVKhnzY4kt5$IhFAi$kH8+0EzWywamTgJSZ4BXXypcNA6w-D+Q0V9-$uDClqFjCSjqSWvKiWNYuaAEka92XaQhiBj+YHClFSYxxtkOR8w18lq2oBYqW5HWLbZs2G+dmGtIQYXEXbi8pta-4xtK0C5WNeSRxEdIEFDtE$ysfQjCWGjoiZuduAD0zdlCe8T9Bl9tHpbKTwzB+KqYxLypI9IZ5ctE+JgFgyVEngZphq5JntDJ53E1JlH2nXfX+p1$0W997zV8dIXsPy1CBEKapm0NdmWzU96wOTSWvHmezSqStlz9hntSMieRaNcuAvHqzYhTD7$xhBMZNP7PdWq-7Tw6TsCnB4lSzd$RW+9qNLReJ1ZMxnBOfpWW+0TDVxiEA$TdzFVkR+nHzZGT+TC$wEfnNYSE3jxhGsF-f3WXfgToJaU0s2tFNk1pamOcQFTH3LqIAoVuidSHme10CC2TOF7$YwqZ-9E80w$3xASJmR9Fwx6pQpQVhkyTDGfIoY6jqdBJc6AuhMlYC4PLRty4TD6jdyTVynA9xHqLf8OTaUV3Qh0EtCOC7TByKW+NX+f9JXyFElT1QueltjlFEEXNdZzETvz6JSQSyKH9V8kEKTcy17hHHymMpMqVBT9ploOnV4QYV20Eq35NlqDEg$TxEgs4fqDjpxK+hIHktEYdKv+hngHYKASxqKovEUGtWfTBRuETYGWqQS$b9Jbp9-qEXoZ$8MUz3iBXIh9U32HF+I5PIb0fsxhBEw+eo4ouPebvwP+C31MFwN05qSWmRXJDHcyG0Xoy6fu$$C4U8p+XiXqPDZIJJ3iaPJjpF4uUwZ31mTedjAmBOHl4ipHhuQl5J+u1ue3AaNjpZHJ+zA75oeS2fQjuSJhBsZ7F8Qc-OpQPuB+dt5hh+H35RTRB6meAeF0JgDSJZw9RjRAFBFM$0pxJLTRFaZlm5d8JcsMQtQ+sRRcs0wLULDqe$JT4cALDCRxZXs9kNUDEy$G1mToHi57NDKU1jQETP2m2zEI5pQDU9-bmj-eRW5SeTD8HRTT1VhM1F2hQmHa5ih6m7$DAmBBF2$v$PeR$j1I$s$kBwU5dTZFWzDqqyRFsXJJW7k0AQ1UJOhwT71+UHmPNmpvmOeu1duMK$+0yu1PTGpg54snBSZ3hIZ2NDAVKAm$pkNm2iA1UjhhTu-s4c-tpyZb-7WMdH1w$GqMWW$w4W5kWmThBNpkuy0k1H1I0idsM02F+pD3hg5Z5c0Qqh0QBNFju7WYWiKgWT5jE+yeUuFT2STt0cNSWLmQPjRlF+sVEY2CREdDMg4A-be9ef5zZL1yK7ZJqCQwk9UTQyRuZMB+Z$syTC5+J3h2J51mpkyXQ3MDAgDhHnNK$KJb5pJi1B+4An-EMzDNJRO2Fa2MwfEOHnZQmkwE-aByTXecJnBeR-HmpGqe$DZ2sG-jOgq7ETT7JnB+AdDHy8MCZJHvMPdXst57WvmGmcJc-+ZjhZRj5mHJhidc-F2Z+XsOh1MF2xq+T1MNp$1U4vOwd-pQ4VHZwH$kTqK8Nts6OcOW53504CMfNyT10VHyyGqiEgJHHiELEYhzJRtnsJ04HvR5eGBOBaTpwg5j5CRjpxEGqvQAPAm-$Yu$KRBuFQZg5KZB+5dT2TOYOmpyy6H6Z+TG-VEFPAsZ5RN-HasDHjE0RhdGtt5g011l5CB6R8wOhM1NpiEbRl5BB9M5kotOOudRSHMvqESktuFVDg5b5BSSdVQ5WvOqASw$FvRysNdjRZdGRT1jhakvtu5JwwHl4jSpAnWTqPZ$OHmR3bmu142g5419QgDpE+TpdTSqqPDtNXZTm7ShK4OkOdD7RFsysX3yQfFAWUBs02qXJJNL1ESC13FGE9qVR5dUQyHjSDt63q$+Tc0ttETCJJHQOOEvRZ5YZ+KMDw$X$JFv3U0K1cZ63STL5qPJ+o0v3xZoZSIys80ie0qMSHNSSQ4ISuNk30y$hJH0AT2-kMHF+0yKB7E$WS0telkukU3TII1uIAMFqqBl4b29NBMgDmlx565dHdtUqnOs4cdRk-58pSpc-mIw$7sHmg04lsRSwDWfsTWdeSwu3-QT5yyX58hzlGZA2i5oZmlGd0pPMb5m3qO0p1Zz-xhuqMZXwh4Fe9kiO8IDOC$2UsTqwGF1MOJvspSyqO$UqkSnBcAhTSmv5nmK1tshNVDbRwRZHt19BNQj2bZvHuWVS+NCm-lbkGqsJ7KCNh4tACXjBSULmfZgldqJDlF-5m1+EplmTv1uO4UZHdMVWyTM4Fs+KMW2pnB8l3t1kDKdu1TfHg5xFwHE$pKPe5daXLKyywRpwFF+s60mpdDI5EIcdh3a2JeDDT4b2XePScNpJ6MZ-N5FX$sKA1OX48RdDupwsZ5702K5d2DlDC5iIwszXdQcm9JsDVIHOzD3ZUtyXUquleMv3NpjSaApXw$g0E+TDeOpXSwc1oenx2Xm04kfJCxqeJq$K$Qg0wk5HfJalj3WnRTqec0cudZdHmxT2TR7BmXFpbJPtamY00pky1DE2bITEHw0p$x5loOLm9XNFEh9qvKcmRxfmADLmVHssodzKo-W5ZZxhLl7-pnT0ob7WASdbMEfRHqg1H36OSnSwT2AQqejI1IT2RXqMM-u1NdmHJHw3SxG0DZ6ZuBx5yHTRsRindDV+Kn8n0yZBbA0y0OtwT4NtDInBdDp0nI30Eh75uMUq13FqnB5RcAHFW5a$0SBZHSHMOHTMb-b2owCRPnVEA+Ve03enMBo2FQbOI$g05dfpYwvBF0dDqKaAtAMWExP-FxTtFOsIKJbJTDPXb5zF1RF-TSueFIZtjARUcwKXkXIWxh4XHKLwm2gZBHm2bbCp0XF+1hGWMEwkwtM1t1p46NqSa-sXSDbkq-dmTdfbsD7yYy7OsOHQETs$n5yKIwzkJHl4P0UBv1w0NWzt6ZVhZbLRN0jtOKwO1I6OCJsTbtUd+Kx9S-uBbJX1dQJnHSGqloUheR8w6nWnIz$+kyho$Iu1TOwHtE6mYlyyqw2qfRBsnwtA8Rkq2sjZT4$MtAX0jwV1V0KOOhibuWZHKQyjNen5eWzXbJ+3b5mxvQ$sGQKeEOKssNv3U1uOcMT4LDLD8RwBqeM1xodhKEyh4H6jh-l-63yTMOuTnBF2LnmHTQzkjp1McA1T+p+u2j19T55oA+L1mjVHpwjhfqIWsDZR+F-d7WbjbRETaQ3baMLUT4jSjMfDGSDzBxQbMENpdolx5SQX1xbx9xwqWo-DdH-HhBMlLNHS5jmES$OXDnLd9Z7KxAq1iKLKBSOSDNGIyNpwR45dhNwN1UWJF2cnxA1MJSS3$sDiNH1HdlBtLNAsj5mOnINpSTNnv30s44l5MkDRCWy9EhqeMW+EvqMWJomjNSdDvFd-EAiSK0jhM17otAEW1+dWIHWwoSX$I5b$6RKKdEhHRe6w6lQsfBzjRS7t1otBFPW+9iIB7Hadv36$jT09fmf5-W6xvq9ompgZ3I1I99WQAFFegJyRUj6ThM5lcBVhqMEJdzujSiwHIiTiH3KxDHToOHglnl6C0qcxEkpkmICltAYo8oOhE75d80dQnIhN+uGiXJZHkz3549hw-tlt$tbIIXL7XouF87nIb2tzWbflEAwwuw9CEARUn18sdH5db2$oIF5Z7x1xFLHb1FEltovdpXt2LD5dp2sqhqTH5iwXF+qs4AISXCK1Vh8JZ2T$Jtzxd1I$wkzRCRz$5jMD0+btQ-1tUompWCzDalO-jlgoRS$01oPjMojx$tI3zD$F$sEtYFoA90cC9KwKKi6ITNlSSTk-NqbSRSula9NxXYY$n1IMjb821JH4OhC9-2SkTH$jOHLbh$MxTHDD2-nBetn591glU-yTCKtN8si5q-0+3zZ+oRYXAFvR$bK9hTqjBYCRLqDolO$oX74bMCi5bHVSIYnq6DTDLmkTDxfKgHwbDYdQjWuCblXZBHliKzFzieJzl4cFCQYJhSu-MHhROH6nM1CzdQJobzBV-2vC4BLxeYpkDbs80oOw53obT2cxDHhStNAm6qeKeUgmFMHdvo6xVlb59qWYeWyyk-gmAO12XqS9eLXi63$Sc$glWZbKJYeVhBCKWHM1UQW5RUzwkR1jf$xQ$tntfM1FCQ5jqqJgRw83hSjuFFiDuJW+UCeIO1ljC5+XL$xY3VA824$X0puiLMze3bYjoCg0ES52D2pCpjkqW$+8WjMBeoItPbAN2qhBgxkYgItZtetEGR5ZmHB9YCsDbQL2UhADt33d$sJleBH7+iHn7y2CtDMHCf3OMEFtbkN39ZufgLD8LRmINN1NHLF9o8EIstS38QFnPqmqlKBY5iSTPSeHFZWgHXwsu1uiGqv7j-XV+K$h1RVhy7OIqoVRep1o6baQRXABhlv3vlwgGi8dGKfKdCE$8RdwsDfqNm5lPjDl0AjSZHvzSewNgmQk0LcWAPnXm2W$GinItbDDGzcm8j$ByHG-IVUYB0ADlVX9sQoeF2fLGJbq4IMC3W672UzR0VN6XpctQWSp1oCBVH3zqxu2t72Tj888Lw06Mgt6xvDE1F3LCRoElo4H5lhTxmqmuGO1KouvsDxn4HJWLBitc33jBZcu$oEv-N$3vBwQyCdKKW+ThBN1$+kFKkTLvTQkGUStpgs1CIjuHy9g3XJ7MnpD5dgS+eetsHEtjNs-l4kyfH4HDsgmB998ZY2gYdAgGm3XhUNg-qAACGl57WaKVskjejFs4jGR1VhXCR8JGSOVGEqAO3oSzSEA9LM1jSJB$s+QWsiCuCKATC5YHqjCT46papEA2I56ts3$Ttg0$xLafaxGT5qx6DELYgiZ8gYp0IDAXjw8g4m27WucDKgtU$wMdDIl+cmdLx$xESvFwGuQuftplgqi4Hx05WWXmpebCm3$+tDDUaVRNKM0x8nBXcfjTTBk2MhC5kz0F8eX4Eo5XA-8fqTXWN7KOHEssJ5pFqkzb53NLe88mPqWONmypXNsMzL8k53b5e8ffWTu8NteODKuCu7WIgKK7TK$1IhSEHMN5xsBJ1Q$dWfv8VZPxHzRwHOEXQHY$tsXFht$vE8i8wxHqs8f298k5Y$wueVNlBRMLRP5xH5R79F5INTB$pmhH9uQT$1W2k+uuFJD1Sv$UxsTUUH2Q$T6pz9OnTPSQDQ-CdiKE$PwU+RhTgsHJ0w5$zuJey6J5BMjHuON5eoR$zOD-mDHI2E0pk$HkUDRDdxQ+hmzWERKATCyI+QIV43uWUEfqO+N8z0zZw7spF+p5bUW3Lh5T5yS-kp83z5pHm$HoE$RtPXUWIDV2+qB7MnzEhjk$y7sh$znEs$yKo5wV+RIHu5D0h8wmk6Jzq5qHu5uupsTFixE8y1cuwEs7fDjITpWJKu11XF5U$t2+9akEsTDScHmFnIIupT5kPWtYp2W7uasQNF-DCW01OTXmOpFxOuWBDck+S+4LIEqp0T7E56leCL56WoeoPE46JzyDW5+6sg+pIKCt0wyikDT1ezMjLTT0dWaRJTQO5RjF-CkYDLXDtAdDm0sBI+JkNkTUPe0k$N+p9+AECwYk$s5mYEx0+GDswfRBQ8qk0SN0Dy0T5u8DH-3Iz5DkeaTwI55yMRyy5TNmsUjF04jnHLpNdhJW45ynB07DFcQj8I+pP1eRPsssMUN5Fu+1yTkDoMRSP6TH0Vhu5XehuRS37TShIK$Fd8zTjsyWSxS$p77iuzdu1S8i++6p5JjjN0TD+YjkN8-$Hd0TND1z8o8BzD0eKukDkIx8ZHky9RyhpFho8bTx-XqSTY-sy$i$FwkH-uSSz+OH5mMDuUuKB7hHu3hMuCuyoBT3HIk4Mwc5+IUHv5a0WRf5EeXExFEdzIEZ5u+8T$TjlEJWBQhv6eTA+bz+WXaf5TXnzFBhsJcySQQzkRizz5070OeJ-BIFF$ps-3oJHQqLFw5KMmPm+xAOYD0m4TjubwwNIF$nDbMCuymh-5eQ9T-yZDLd+fgi8L5mP93Q+hhQdS$xw5JuMq7WE2IYy6TuzaTfWWLCEUS5l5IH7o+mYJ0GJ5T64D$hP$Hke2CRoMhNECU4oMWiKQEX46m$RhcJbHowa-7F0ypqP5TQ2IlXCHL+Jspu6P61I+EP5Z5ZH0ewjvmPADtNTDcDQgUpiRR0PApEz$W5E5B5+wvBSUDozWjdynTq3TDzMORz20G5Rmm5zesq2ATUmmm9fWvzS3F9iuGpK+5RpQYssBsqLTltQ6+zh98wZH$PNAXR584oqXhf6Ws8gYllxBss0U07jAq54z5jZxP8T+l0sMjKJ7zRxtlkRcD8hlmok1HfT+TIcHJIQTTMQWTdEmyN7DDhsEygA555stkESEeEL5PGw972jPEJUQkTUKdW50mKU5-+pvYplCE-D3RS$ADKM$uB4+YWEw6mvSxy6N0DHm$dH4hmZngInpQEK7FHl7WuDJzxHdVF7jnhQEXhaHHH5Kwss9tbCOZOLDR1eICRe51tn+edeNIEBoj$WeKCzGA8NyWwxhVT2H6-XoIOsUD9hTThQhWElMmMcyS2wZncFF53t0T5lhQNwMN0W0bR5Jmb563+HsuZ5oBhQNL+jT8tJ20ggDH1lBsKJVDgPIE5bTaCtkAG5+O3EnIlpVt1FussE$$5bjWRnm608$nfIDjF5gm7txj6q8YU35kP-ACS5C3+qUD-hd+$CQC50HlTSOuVthI4Wywg5WHXy5jWzimjG$F$wHhdhHPjR5Da50KhT5X8ZH$Hwymu+sIo+J$QBtyKHxw8-$ITHs7kGK5yECznXZTIue-OSI-5MwBHsO8JC-RlWMofenIDdCIvSjpXCSlmEH$i6qUF00$Ui85OS8kHjM7TJm8p5VTJWi$lTjRhdEVTfFN$T-M9SdD0FuEdz7PlmKB$8xk$15gd$gQNKkXQW0ioeceHUF4xzmJ0HsYpXUDVTeUw$T3$+hF8eIC03qD3T58JDRI9m$hQ37k8b5VNY8Z0QMbwM-f1q32WiJ3esJPWvOV00RvSowtTItM9TbqC2zwyU+lW7Bau8SmTXiIixLBK$YHMvodo4B3PNiz5sfsNuu$nHJ58STdpD$Dh42JD93JQODYf7vBvD8SJbpZsoRQULiD3Jb52zZHzTBML34HT1X++eWx5vq$4WdXcx+zDWbSC56ZJlEyiOqHIBGawYchnVqMK3REG-X5LaTfiD3J+1Ej3meHp$DPzeUDFZpRXqlwIsH+c7fOwj0yiwzecHS66eBJ0EZ84tHNn5mQWqlHTk$WJSDfmNiU1Bdu2FiIdqp58HWd5dogM+ERhdIJD75HlXLlmp6kzEt+WDL5XKoa4p4vS5GjbWe7pwxuWd1zO+EvDXEuEc920UW5qQ8SN+uCFTbkAJjv3RUqkui5hJWinTawT9NHtX8QM2u2h7$uPth5ciD3YhuPEuEDX+QvIbmQNQP-4XMqKIfUHi65e4fZQ5IcweOwLEVlH7PAkqaM1uUCivq6TppPOpm2SFWq$HDeUsCkFeJRQJH1pmJJexezxRGShueNCCzDsoR2lLEkNwR8NRUuSEcEttYNXdDBMW34YQ9F5dwsc4YIZX0B5kbLgmoomuzIdTaNsq9Qpu3U3$SHJSLn7B3lm8BXHJoCx77TGRW3B$WJs77nl8p-SYfxJXdRMl0$+OheGQJIuYSZD+RE3zwUWipPZqIbOf$yJ6QIsDQQZK8h$8P$Ellm0HxyzhS$$alDEntB5eqLQkeHJ1$dSD8EEDiD3aqHAtPG4UxU3ZAEmAI9hyIZQpULdh$Kh$9RmRMw7N$0DbhyfHmB5WQU+hdO+zP2iSSQi3Yfh8j0uPZlm+zFb5oBhLZ25wONIgxSXiiwOdmCWX4QyXOX14zkDtDE5zl678tHmxPT0IN+p2NPxqG0xWqwWHU3XfRRUh0FW$G9+DTRtWs4QejEqsKP29uNVQxs95C5IpPw5P-EJipCXx2Hi7xhbf7zCXbZaOtnQdRB22SxiYX+AxT8ZHG5BFf3FJ64sT9HnAR+tpjfzfUiWSmeiDNFtbgPeUD7ekj57xos1qD0n2j-xD$9BtimnC5x3Kh8fglqIXkwG$XBL7Xp$u3x5SR6BGbftqcSoKjNDK2imqLVue1NbJs+GUlLU3pw-bpJboXq5231KLxKv6iJbq0lE2UoDSg8s9tPleAtT$+yxJbizlsAk1KNG8mmMAnh4iIlE6NJ7i4n$QNZDK-7JALxlbZp08-buERy6I$2PZKD2ifgqFPE2ZlpZtGm$MZ-$2WZfTEag82vnY4LtJ1G5faq+EcRiZSLdUf3LHI4ALxw5eHJRYyI5A4zJZpfsQLHIGUWXpH2q5NjfXFEZXYWyJHFyzX+wcx08hTsQLUIcwoWlBGTX92KxsjTzfDL6ISLFINF23ER-YmQLdIzf7WJ-XPJYlZWL2cZsTtukU7qxDBV5aB2+zpQAx$2-0Sp2mnQQHxgJJ0tMbosKQbIDPWXYyyUin2jIg3QCoHxfspY7IUwk-XBbefEsWXmfSOuVjukdYHlbAUjaPyRdPYcI4FPjaPtHfNYHl2Fbiw+eHnSLulOHFzDKepf$YvsvTMwXZGps0KelkJbzwsGxXl7An-p37ssFoXt2YSXpctaSGKXOSOnL2c7pCEdfLpIXMJMBhStAfjQbnoBcxKwL5KIY2bSqdWsEg2nzQgsF+TzwwGdsIKnx-q4HFey2dY7JlguHYsx22XXKB56JWLpCEKdfQebzI+RFZxnsp5pTPR24Jb-dgamqMyRfWKCm4Rh$MxMHxtToy3i6ncDqPJPzpQO$bL9E+5OhhsF-5lQPnglF40blFEysxHok6H5akGuKU33FREq6ZOuDTUIxvHqq$-i-gtYPn5N2+CFt4EGKRoaQA4XdRA5S0q0puIRxhU+ED55598jLH8L5b5DHa555It0EV$TDTE$Jjf$7SiVskIM8G$RTITKUKPQymsWOWSkWH7YxwF3vKTqTpuhpjBy55+wRS565EM5ROLHFRzqNP+gQBW5-9WF2615dzXUPDbRpTDtzQgBOxR2-muw-QnkP5k5ARODE7y55sGHJ455+ySo$-iHTkJKtOWi5C5SE8YbeIH5EsU-lyhLLMkBAio3-lv0DQ+5UVhDT-H4QYy5zwT-lvC5Bjni5P9T-lJz5zx5NWCon-mfXZm0Us54oHyOD518iv3A0oPUsuItzB$PVy521kvfYLaQ+$1PypOhIgtu5mCsTARuWCtmdtOWx5SNem+m6nvcQb5HQiwIv2u59VNHJ5uq6vegWzVCHpuEH5O8yzcQd5y+85eN+dBkzn$syskTUHGM-9z+y+EqEZQ4W1ymRwyEhFCbV58AaBFNPu6A-QFjnTHWkPNSi$w0XD2Ppuxbfjtw5x$ou$ZjiHUF5QBHUoON4gSC-LRkAVTy+wAle+h$587DRNL5e6ec5XV3R-1gUFH$IdEHiDm5z5O5EsE7WDTXhjzIXFeUuAw5DQ8gwxx68mjDTHOawGUNTgW$7DbRz2IyEuz+FmzT55qoRE8qJW-z82P25RSREJW0W229K6zOuIOH55MNGLDQHDLb01SbQKFMklI4oWNW8hCbOksVbuXNU5vjy2tPVktE$68p9hnSH5qoEk5b2gMOWmAjzJ+68D58PCbu5557R5$pDs8Cx5jRM05VUhP55I9czD55"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\ncontent-length: 0\r\ncf-ray: 9b0ad5c20cdeb4ed-OSL\r\ncf-chl-out-s: 6eOemzXSzbyS8JMy1QkpjQ==$n5so2LQ91zLhFhqd8WOPjA==\r\nset-cookie: cf_clearance=s82rV071loK2I_eTOn6v0Cs5jNSwEPcK0lidytGtEyM-1766188569-1.2.1.1-wiN46m7HZ1TtOYp7vDAnEmmm09TODYhSg23iSGQmcS2spRD4ZoRHuTgisAZfKfIh6pTA3z1krogY.mQegd13ElTdCOhDsM6zm.GPhuCjwdDbY2le87zN.Vv9au6hhyPpMtU_.k_d4R0uBmTxvRthe4OeSWe.u8ElMlF1.AcGzRUeJyMsz9g4UGHsSZs6trT8YV_.Qp0HvL9SJ0f3u1eMXa1RUh8rWHStTzbm9yQwRbk; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=gsh-services.com; Expires=Sat, 19 Dec 2026 23:56:09 GMT\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=i2d5JLlcICL%2FIXkdpaMqaY3aQ33%2FvW6eneP8ITr7ZdjHHV%2FFk1KCS9h8DEE46uawmLSDvD8fh611SmMH8vBo%2FC77frdCnnjfOOcvlb87o46%2FjnH61ItF1SZuXNatauVVkvYPhEPlHw%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=2018\u0026min_rtt=880\u0026rtt_var=1422\u0026sent=716\u0026recv=393\u0026lost=0\u0026retrans=2\u0026sent_bytes=650291\u0026recv_bytes=21480\u0026delivery_rate=50366863\u0026cwnd=256\u0026unsent_bytes=0\u0026cid=51aedaa60604b1d2\u0026ts=2228\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-12T12:55:59.554947Z","times_seen":13662418,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/assets/icons/icon.png","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:10.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/assets/icons/icon.png HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=s82rV071loK2I_eTOn6v0Cs5jNSwEPcK0lidytGtEyM-1766188569-1.2.1.1-wiN46m7HZ1TtOYp7vDAnEmmm09TODYhSg23iSGQmcS2spRD4ZoRHuTgisAZfKfIh6pTA3z1krogY.mQegd13ElTdCOhDsM6zm.GPhuCjwdDbY2le87zN.Vv9au6hhyPpMtU_.k_d4R0uBmTxvRthe4OeSWe.u8ElMlF1.AcGzRUeJyMsz9g4UGHsSZs6trT8YV_.Qp0HvL9SJ0f3u1eMXa1RUh8rWHStTzbm9yQwRbk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:10 GMT\r\ncontent-type: image/png\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 5833-a6e0e258183e4c359db5cb442aea1c3273d784a2\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oCFF1jN8HgQZsiTFlHLSDD2b5XkiUzUA2ziaPP2WCSzYezC%2FUOsTNVdNqn9DMKppUmVcFDguT4mu81cO6bR6GYUvRhidSTkLmewACXmnlFV%2FCw%3D%3D\"}]}\r\ncf-ray: 9b0ad5c62fbcb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5833,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1000 x 1000, 8-bit colormap, non-interlaced","md5":"fe83996513914cfe1565b586f6507fbe","sha1":"a6e0e258183e4c359db5cb442aea1c3273d784a2","sha256":"4a9308928297ea896c6073d6eac0eac6f0a1f949da665a62c4d69c35aca5433f","sha512":"4459b9f11a18c463f772afde4a1f945907b37bb32058a051a21a5fb9d5959c2725575c58b9b8f7fbe609cab086b37f31ab0ec28c93af46fa043afcbe1b5819b8","ssdeep":"96:mH5HqrwCiKpKTk5RFIT3HcOlvY+Z62XnZ03oAVaG/kDt8KxmK7KTpKdwRX9ZMar:mZHqrwvKpKY9IVlvZw2RJKkR8KxmK7Kv","tlshash":"d4c1f9567a76ccf8f8b4257d460607b8db083600796f5e600ee356ef15b091d4abc85f","first_seen":"2025-11-14T02:09:21.927893Z","last_seen":"2026-04-11T19:58:30.838092Z","times_seen":45,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/U3TJVKBR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.968Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/U3TJVKBR.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 360\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 610-8ccaeef4b4bb77b55e9d79f7046fa6090871afa5\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L0jRj5Dxq92etrt5Dfqj4FfZ4R0O%2Brn2wUTR%2BloSvzQ2DU440OP7iOsXNP6DdBl5tj66ptW2uEK2GYu%2FTb5uHh7r9G0LG9vuYgNtgPVU7LADXQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0979b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":610,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (572)","md5":"f9b51c6372dd8ca2335c14ead454c6ef","sha1":"8ccaeef4b4bb77b55e9d79f7046fa6090871afa5","sha256":"0c95d7ddc397d8e1b58b336e306e1eff6c29fa7163c9221122afea2e22ae855e","sha512":"4c6458c98ee3a38890473ed6aa38b68faeff481fc131494f9138b4b916ac9904c7dbe94229fa985bf776951db861388883556eba98d5b14c1e058e6e68c63e61","ssdeep":"","tlshash":"1cf0781e3ba8e6f30db1269946a55746f23600b8d35481a0f72c809a2b27818c0bbe20","first_seen":"2025-11-09T11:09:19.476867Z","last_seen":"2026-04-08T19:10:30.738114Z","times_seen":42,"resource_available":true,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NDFDKX54.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/NDFDKX54.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 25547-4c8065833d9e7f334e5d99aceb76c939f7af6b4b\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w7JEzr2UbA6dHULmrmI9zPMUYEcLj9eWVcr3GvZdBRgxWwTMptcN4Vf6g1ob0hVfcLpWgYk%2FiUa1WZMDGxdqvzAcLQeTGmXSxhi5FPwul9HZaA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0992b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25547,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (434)","md5":"a33c0bda4e33d2406fea29846b96ee0f","sha1":"4c8065833d9e7f334e5d99aceb76c939f7af6b4b","sha256":"e86e5c9b61c4e2f0a5cda07aef512bbe8558959ea96e6e3ca149e446f20b58a1","sha512":"d85121d5ba89c5bcc9e282a9aed7eb4435c9cdd350c8a006d45b662b2b380174a6d776be9cae7737c6d590c04a95029765433ac470dc66b401dfa1d1d9e4a593","ssdeep":"192:rN9FlsGRJEJBTnEz9Z1fYoT2ZSt/sxGpMAFov8Cqso4ZVbwYmBtqo:/JEJ5vMsx3Eov8/4TbMtqo","tlshash":"ceb22810553a447779bee3f6e2cb4a18a39c1882c908d8d1be7c4a574fa07bb71327e5","first_seen":"2025-06-24T21:11:18.008658Z","last_seen":"2026-04-08T19:10:30.72459Z","times_seen":212,"resource_available":true,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/NQNIGDVT.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/NQNIGDVT.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 34252-4551fbcb8613b7233b5ba66519346b5b390ab0ee\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jkTlH8NPxLSwhApRH9XxsBNnVYLwkDLXT76nrhAfmf%2FDqMNrnJ48WLEcWN9wQhIp61MFT6heOiAP%2FC2M7JCA7XnIBXDSAbBfREZ3QpCu9mgZGQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19a6b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":34252,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"d918b0bbe3fcd4f5482af7b8f9469390","sha1":"4551fbcb8613b7233b5ba66519346b5b390ab0ee","sha256":"bfe90818e73f4cff72c8ed895eb0207e3538a8d52335585bfffd631ee4fd489b","sha512":"ff6a03fd3b289187847bbcf8681ab833fd1efc5693c5f1f6616ea5796b4740d7fb13bf0e492735c0e6b9737f43e1de53d84cc28349d42152d61b2223fd0f199c","ssdeep":"192:k4h9TkOTpRyewmRAYmbP9FZemNxaVCuXOTOROeOEETP6Ri69nk24+OgOg:pWP9FZn5il1Qg","tlshash":"6bf2e68218ba4339377fdb7e61975348f3be3cc58858ea45199cd6b208f436d225e782","first_seen":"2025-06-24T21:11:17.983568Z","last_seen":"2026-04-10T14:05:59.669841Z","times_seen":227,"resource_available":true,"data":null}},"time_used":347,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/CXMUDICA.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/CXMUDICA.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 278\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 342-26addf2eb4bb44190386a80877aaf349c99190b7\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SvhLjBh2a1SjaFzxfLUgGWS2WLlwHJr0yGGBpj6jcLI89kV7OOjErfMT2Ey8g3HWjL4EY1VlvT0zv5fo01%2FzhbiRJkFMZgqlZjigz8gTjeGXbQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19b5b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":342,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (304)","md5":"d24cc2278d414a8bcb448519397d04fa","sha1":"26addf2eb4bb44190386a80877aaf349c99190b7","sha256":"79216a7cf719245824f4cda8b4719d2ac16c15bff4567473f58f6657f5c33550","sha512":"21f56b2e631af189efe9644ff4dce29f7232bca9102e790f3a754af91fb92ebe2cfa4e4f0e58cefb33f7c149d432c06fc1914c976db8210a940c99028129c384","ssdeep":"","tlshash":"83e0261e8c7049f6275218adcb5a594703285966e369d2f4f2cdb92413e9148846f711","first_seen":"2025-11-14T02:09:21.937101Z","last_seen":"2026-04-08T19:10:30.722065Z","times_seen":41,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JA34RR57.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/JA34RR57.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 530\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1166-287b8483bf2867f708860773e9ac3128c8b8ae27\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bzBWZyQ0%2F6LjlOGFsGzBloRaNZSxUHWD2cuBRht1i20GetGJlYKi7lr01WYXd%2FfG4Tvv5S9ESzYHkzCC8sf5mIJbZ4UOuW5uoC3%2Fi0%2F%2FuYU9jg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19b7b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1166,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (1128)","md5":"a80c9778caa48b062231152bcfd37e78","sha1":"287b8483bf2867f708860773e9ac3128c8b8ae27","sha256":"a91dc62aff2ca899604be0dd33175d13292433c41795ae4303e1a96286fd10dc","sha512":"df511bda50b264ba71f2f58e0b6abd2fda903daa2c45ae6d04108b88166716d9e003b99e0eebf0029fcc389b387b9d1e3f1aa22af38ddfa668e92e6338ee41d1","ssdeep":"","tlshash":"be21ce866f7d1b7920dfc2e36d46951275042081f14e4c6c343d4ae897638c620b57f8","first_seen":"2025-11-14T02:09:21.975712Z","last_seen":"2026-04-10T14:05:59.698338Z","times_seen":58,"resource_available":true,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/UBVAKJV7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/UBVAKJV7.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1016\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 2930-01949710cb962ad5b39dc802277e4ec5fd10e7d9\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PDu7tTLUZMLrajuKnwc7XxGcL3gCn%2BkoRe0ej5UtwRiy9WT2xOdh5u2yJU6qv6ZoCh5RH%2FeO9%2BVb0CFc5VDDZJdglAwZXJuFHQPxbCXI6BKRUg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19bfb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2930,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2892)","md5":"ea8498c7d41b40205b15f490c90dd40e","sha1":"01949710cb962ad5b39dc802277e4ec5fd10e7d9","sha256":"cce54081ecfaf9519de94be6d8cbf953eb351f6f9e9a3516afb2d52fb089c00e","sha512":"9c8163092e6ca13039b6d52d75c75e88827a8c8e4da15d039f680d4ea6e892e60672279a529ddfda061cffdb90e4cca18a4ab74e8002d445001c90005009c970","ssdeep":"","tlshash":"1451ceb67e92b4b073e2f2615c934e514319f984f801c83c3ce858d982e5e8d69fb6b1","first_seen":"2025-11-14T02:09:22.04018Z","last_seen":"2026-04-08T19:10:30.705159Z","times_seen":41,"resource_available":true,"data":null}},"time_used":280,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/src/flow/stages/identification/chunks/GSHAKA5F.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:11.531Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/src/flow/stages/identification/chunks/GSHAKA5F.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: cf_clearance=s82rV071loK2I_eTOn6v0Cs5jNSwEPcK0lidytGtEyM-1766188569-1.2.1.1-wiN46m7HZ1TtOYp7vDAnEmmm09TODYhSg23iSGQmcS2spRD4ZoRHuTgisAZfKfIh6pTA3z1krogY.mQegd13ElTdCOhDsM6zm.GPhuCjwdDbY2le87zN.Vv9au6hhyPpMtU_.k_d4R0uBmTxvRthe4OeSWe.u8ElMlF1.AcGzRUeJyMsz9g4UGHsSZs6trT8YV_.Qp0HvL9SJ0f3u1eMXa1RUh8rWHStTzbm9yQwRbk; authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiIyZDV6Zzh3NG82aW11ODNld25nY3gxeHBvNTVhZ2l1diIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.ASjK_fw1Bbz4A3IrKYiyNtNNqb7ZnwXrNVYVNOvh0H8\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:11 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 455\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1604-bbb401197efd85411ecb7a4c4ebda9009bb78901\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LQRM0mYAZ%2BXDeSUv1U3CKdQees6lxmqXKHZx0Z6E2PQacgiM5eptfFc56woQg8btCqjG9Qs%2Fqov%2B9QSpVLnLclsTtDSHB32I6UhOXszoeaoiWA%3D%3D\"}]}\r\ncf-ray: 9b0ad5cc1b8db4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1604,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1566)","md5":"36153e985c92d43949098d7417d420d5","sha1":"bbb401197efd85411ecb7a4c4ebda9009bb78901","sha256":"733cdc5a64fe8ce0fe1d3699c15ef63252c9bf4374e74130b2eb7b3b07135b6c","sha512":"7877bae7fa26f90125e39c8a799a24d2f76c75860f074e8f7fb87b3c0b5aacc65edda1798a44aef4caa0ef079996fa684f71f57eb115430c651fcea0d81834de","ssdeep":"","tlshash":"01317fbbc43071574095dcb5e608ae6013328db7b3a42fb6e0ce177dca56137861d421","first_seen":"2025-11-25T05:22:16.00336Z","last_seen":"2026-04-06T09:43:18.642952Z","times_seen":18,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/flow/FlowInterface-2025.10.3.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:08 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 33483-76547a1c8a1f7961d4864b081eaaf1e4a5da256a\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p%2FbFdYUCd4EmyNgxUo1ztRUbeJjh8D5NK9Mho3OcpzRifitJi7aYqKECZ7KQmcfNLdayD7ATCQ%2FXQC8Ymh5r78pRhH3kFdDJ6y5IX3X%2B0awtew%3D%3D\"}]}\r\ncf-ray: 9b0ad5bad8beb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33483,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3142)","md5":"1121d0b3b801548bf8e4aa2a9e23e0f1","sha1":"76547a1c8a1f7961d4864b081eaaf1e4a5da256a","sha256":"f876066facfc879ab41ff79097636f701dc592bf699bf71208081f2328465fdb","sha512":"5da742a772f8aebf8bbec8c456a6b0d768ae08435f745cc25c2ebef099beb2c97531852c3a7f667f04de9d7bd2d6fe5d6ff75b49a1e1c2bfd2338dee8fb8c298","ssdeep":"384:YUDQtWNGi/zdM+/ZBA7MxmlM970oLIZvearWIui9A:YUYWNF/zdB/ZDYlaABZvJrWtv","tlshash":"d0e2d60285f3443f1a57cbb5e12913526538149bc148e6fcb6ec7be1cfc5c21627aeaa","first_seen":"2025-12-19T23:56:48.629679Z","last_seen":"2026-03-15T23:51:01.076421Z","times_seen":5,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/Y34ISDHX.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/Y34ISDHX.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 236\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 282-e8b29e6d66f2ade80c75ed6b8f37bc7897a7a8af\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g4hBig4twsDoCM6aaOz198hptn0C19X4h1ljxMRWOw04pY7%2BekVMwSrmEH3annQI94UZFocZrFNBdyzRJCOyi6mno3MUNkR9CJ4lAT7gaLJenQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc097fb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":282,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"95210c62287e6ca39b65f10b81bed357","sha1":"e8b29e6d66f2ade80c75ed6b8f37bc7897a7a8af","sha256":"140f8f4f55472a0c0f6aace4c0c5ebdf2441a658cac23c305f853b4fc2a43448","sha512":"7e434f1961e980b23b7ec65a33053e4fd26c59b5c715287c30d774f6647da36d5abd33491233adc8ab2853d2231913d340de07aaea93f0a52ed69aa4db8b99c0","ssdeep":"","tlshash":"5ad0eb67317c3eb7527382ac202a8008883451a4b43e0ae4df3055b58ab0488c0eec29","first_seen":"2025-11-09T11:09:19.567249Z","last_seen":"2026-04-10T14:05:59.687271Z","times_seen":59,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/EV62FGFP.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/EV62FGFP.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 883\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 11532-9364bf72817d1c07400c05ec77994e3e393b4f87\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sRxSLTIOgM2oHkBi%2BGcInnaB3c8PSbYL9NgEKpQKb%2FsyMBEwLnldO9xvFwkKvXnTsN%2F8WPkYuM2ldZcW7%2Fondh3PYCBn7glUEGCS7HohSyvHZg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19a0b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11532,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"dca6b11d169af43348aa4561aabd499b","sha1":"9364bf72817d1c07400c05ec77994e3e393b4f87","sha256":"aebffddf94c1a1df3aa5e052071df2f816c51bb56117840759e2cb336dff36cb","sha512":"48a94c978942d24590d83fa5ddf2fe0922be83fa5e196a3f97356aefa70ec9786f0f2a523d85d7642243343fd75504a4119b87574af41cfe7014ae96f2db7040","ssdeep":"24:1Y7O5EyaT3Ozdkwg+rGJc1Oq7yWgTzjVDmPmcOOCmRsojQQXaRLLZbTBs03cMrmF:ZNktTnVMswsmQrH9s+cz34/XNEsLY","tlshash":"fc3239951d7bb4b0d91eeb36dd19b7096f2a2cc68b1abe10cee3ca0606b43f67453144","first_seen":"2025-06-24T21:11:17.981713Z","last_seen":"2026-04-08T19:10:30.731652Z","times_seen":211,"resource_available":true,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":278,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JDUCA4U7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/JDUCA4U7.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 179\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 171-77ee9d6bd8e5832cca01d5809dbe4b3afd321ea4\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4BGUe%2FX7pVkMhZGWXo3mYcxQPe90lnrRrbpx%2FOHWomQVzx6SZ7pwC%2F2zSy04JbM%2B3YEVAdFbxsUkEMF%2Bp6SUIJqbhg1BZnmVsEDB23EdPL8vmQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19aab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":171,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text","md5":"b15b78f9b0d2bcef544cd38e49f6422e","sha1":"77ee9d6bd8e5832cca01d5809dbe4b3afd321ea4","sha256":"4fcc3f94d9b602aa1472a269dd23366d865071d85d54debb581a6497e04bc447","sha512":"808e5785f60f61777e25890c4b0ea83bbe512b9a91040677d684a52a803eb740c164411b8fa6ed448cd0cc09d2d21ed0a8c2dba3975f1f395a0ecff668836ee5","ssdeep":"","tlshash":"c4c0806f75757df1f90a187d40577441533974e543411084d00150b753244f49e79f18","first_seen":"2025-11-14T02:09:21.943437Z","last_seen":"2026-04-08T19:10:30.717268Z","times_seen":30,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/PNATKN5E.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.986Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/PNATKN5E.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 794\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 2089-84ad66035521fd385a8d4b32f2f057f20bf6e201\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fsiwFpGxhLT%2FpVdVSVNBiSmKwAf9PJTQ7Lb1BjSxOYhCQGeGm5q%2BQRZm3jszLM54YlyGXc35aJd8aBN%2F0PwKFWlA5RpONIHIKFDeXYChRxbRqw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19b4b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2089,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (2051)","md5":"f926351573f41c02c6c5eb7b238f8a6b","sha1":"84ad66035521fd385a8d4b32f2f057f20bf6e201","sha256":"dd04164d1a341954224af292cfc60de0565d47b93e47db507fe0f5557261f5dc","sha512":"ea8d47bf2754438a22c658e65515b18889e26dd1281f07226287174a84f32a280853b8f31913e4d1bf1317a76e4edec11e3ebbd54bd57ec4290b8085fc0a5531","ssdeep":"","tlshash":"2341331263a29eba71a0c4e9ddc41121c234a695d3c680bc345c7df4c2b3cc1a2afb7b","first_seen":"2025-12-19T23:56:48.633885Z","last_seen":"2026-03-15T23:51:01.087809Z","times_seen":6,"resource_available":true,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/JHYITNWG.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/JHYITNWG.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 960\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 2645-e31b223d0b1e9906b0c3109cd2311741421a7f3f\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6Vn9dj3E4IPCGIOvw1ig5CQuYCt6zLB8JZFUq7YeyW7zgqUHuX%2Ffo5CbKMFh94t2Wr8sxAnFst7dpolOJkZrbOrIl%2B5%2BuGN%2BWIgwSuVEu%2F5rhw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf96ab4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2645,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (547)","md5":"7b20627aa6928c65b9bfa33fdf4724af","sha1":"e31b223d0b1e9906b0c3109cd2311741421a7f3f","sha256":"0e87e2c4f12b7cf9cddb2413bd181c073e6a7ac8ff268c1a03b4e92484677596","sha512":"a95382da8f2d0e147354dae2372833d9a3e21ac9ca70d7417f9809ad109eb91808e70b0584a7baf4607e1018179d2f0a5aa7530af6ebf8e5a8c74a12c6708402","ssdeep":"","tlshash":"eb513e0614e1c4ba059bc7f1c1612b232a34a4538348d2f472fc1ba58f72d87906fa2f","first_seen":"2025-11-09T11:09:19.443876Z","last_seen":"2026-04-08T19:10:30.730596Z","times_seen":31,"resource_available":true,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/AHNPXFZN.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/AHNPXFZN.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1137\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 3199-c5e110401a8ad8d761d170d09bf4c4bac22383a5\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dWgUdCSwO2W6HqxrsJsaNkVlR1iyV8QS5OKWARsQOk9bWgT8kk07JCCfsxHY8RTt13ojHH1p7ZmBuUsUFEPHsuZx2Nq3z1ImyBc1wjmUIgwc4w%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc098bb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3199,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3161)","md5":"001511fb3d2073f89dfa40bfa6441930","sha1":"c5e110401a8ad8d761d170d09bf4c4bac22383a5","sha256":"01fa14dcdd6f79c9b58b3e2b13cd77c815b7693a3f292a3451a4e14ed7be6520","sha512":"e52c2adce7bb13220f1a85bfa9e571e6f6db5edcce44698bdb17fab0aa46eda5a679ed066480efbc50acdc5ece8773d2be7d2c06ec8aad43e04e7ca8727a671d","ssdeep":"","tlshash":"05612c6ef2602a5267c71f92d28365c40171b6b65510d013d88ecfdd3d6e809cb233db","first_seen":"2025-11-09T11:09:19.516259Z","last_seen":"2026-04-08T19:10:30.731071Z","times_seen":31,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/FDUEPPL3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/FDUEPPL3.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 162510-c8cd8c6f9603dac5dccbae7e6f2c906867a4f2f4\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LZra0lbQ6tN%2BoCWM2qzZXBIxUNpH6QxmkjRd1E5MNcFwm3pWUc1Bdo2Q2I7223Nsx7Fhuq47CdBKzBXNqzh%2F1ixLlCLQnwKCfyayO2hOZDvpdg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc199eb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":162510,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (27980)","md5":"e22d3c923e2fc3a64514f8aa8d47cba8","sha1":"c8cd8c6f9603dac5dccbae7e6f2c906867a4f2f4","sha256":"9ffe27709d42f0609157732562803d36856562f6986e82eb410505d6f61667b7","sha512":"6ada93f976d6ff85ec5dbe203e00bc2a400cb65863886e1edd56af156d23baf1068146d668b42698a40548228f5804110f194bfb3c1b5f1781c292d3280b453c","ssdeep":"1536:wvUoWH/EvUrNN0KoeDmC71zd2fZuoAUFzcQvea6FYLSt3Djt71ddP7pcQQcSiXSk:Sw+Ur7K5mw/v6Rx9PQviXSKSQgB4eQ","tlshash":"1df3d5e97296b13243eb0335a07b4106f3b95d90544e8128f66cd6de3ba8449a2f7f3d","first_seen":"2025-12-19T23:56:48.636845Z","last_seen":"2026-03-15T23:51:01.072345Z","times_seen":6,"resource_available":true,"data":null}},"time_used":462,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":462,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/HDNCQQEU.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/HDNCQQEU.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 597\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1497-baeaada7b4ad39e9aa98d464e6b1b1792be753d0\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rI%2FcsKtP%2BaSLyEkMqynNfFel7ZYQXOIw5z4vi92hRBjqP60vbl3oncjo%2FfvGcVG79Lnuy7f98X1UL26DO2%2Bl1OBff%2BZ%2FP9Kpvcyi1Nymb4845Q%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19a8b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1497,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1459)","md5":"37f5b9344e49dbf231a5c6a1ab9b225e","sha1":"baeaada7b4ad39e9aa98d464e6b1b1792be753d0","sha256":"0b1ef38b351005c03bbc972e1e1e7a794404fe9fb72ac99bedf8499e6483d506","sha512":"7a11ab0c8ad6874794a091638f90f477c8a4bbb633b0000b00b1eb44d78ed54ce275280b8d014e2e89dc111344865e05a4621ebe98e34d60988498a8375d22a7","ssdeep":"","tlshash":"c831f12fd52e68374e035dc3399e331286e69531533a7a32a40e9e7893945ce01fb634","first_seen":"2025-12-19T23:56:48.637886Z","last_seen":"2026-03-15T23:51:01.038972Z","times_seen":6,"resource_available":true,"data":null}},"time_used":249,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/TYMPEHLZ.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/TYMPEHLZ.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 17741-712de84aff8673ce1b180b9541ccc461ef450706\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fhwqWLK4xFaNoytBay6yXnd5JEr%2FK%2B0eQlkT6JG30T2m5ZvzlS7uA9jiTLYalsROCyosZUFFniiPFEC3V6LaxqLfZ80DahOjnvcdklY6SBSUdw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c8b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17741,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"data","md5":"c98f977b76a3274ecfd614ad189b3566","sha1":"712de84aff8673ce1b180b9541ccc461ef450706","sha256":"67ea2c2fc1db0ab9bd83b7583ceab300d30d50c6ca37d78352f2ad30d7bce5e1","sha512":"b3e7aaf4ab2f0751d7f4e578b23e4163e67f740afb3323d4cdc4d247a77a0c9c805a263b080fbe4c9c61d5cff15e775afb4d5a34f5b077fc7bcb210e4fb7323f","ssdeep":"384:zu0L0GYDpLC3o2yJ0K3zJnmffgtJPfCAxqq8A/a:a5GYF9jJ0K3zJm8HCz","tlshash":"0782b75473eaa5b24bd9c2919c76010fe29030d8383a442cb678b9ef5468e86b1fdf75","first_seen":"2025-11-09T11:09:19.434882Z","last_seen":"2026-04-08T19:10:30.730082Z","times_seen":42,"resource_available":true,"data":null}},"time_used":349,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":349,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/api/v3/root/config/","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /api/v3/root/config/ HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nX-authentik-CSRF: \r\nbaggage: \r\nsentry-trace: \r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:10 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 270\r\nallow: GET, HEAD, OPTIONS\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-language: en\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\nvary: Accept-Encoding, Accept-Language, Cookie\r\nx-authentik-id: ba0ef1e91d5a4d769f3516398eabaeb5\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: authentik\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kpAy66nrjol%2BQQlhMSCgXK0PjOsw%2B2k3f6YON7GE%2BM3Laru4FXcEZPW8ChVdN1w61AI2DmfNrurIhvh7HNzjvZzlVKWSU1wKGrHrKpM%2BYXRX%2Fw%3D%3D\"}]}\r\ncf-ray: 9b0ad5c17c8fb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":375,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d04444af5431ed47ffa69e5227cfedbd","sha1":"17e0b9db7ff2c6cd2fb41b1c7b35775c086f051d","sha256":"1ad61ef366665602675d338520d47001e1f0b188243ab82536c208da11c81be1","sha512":"d429a919ab714b09b9694ca8e528cdc3238e37399d38913a0fea2ed5f44fdcffedd9b6d033aaa4906cc89f7f1d060c9d5cdc6e701da3cab787133432aee58927","ssdeep":"","tlshash":"72e0c028dfe4d89783d48314882c578a8764d310776571e6b64047b011cbcaf1007112","first_seen":"2025-12-19T23:56:48.639829Z","last_seen":"2026-04-06T09:43:18.649509Z","times_seen":5,"resource_available":false,"data":null}},"time_used":766,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":766,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/6UOMW4P6.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/6UOMW4P6.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1793\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 4505-1c6a3e63134727d4d567e9950d3dbdf34133c392\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kS9x%2FepnGk7%2F%2FhjlwhBlym4CokreE4N%2BWDCeDv8w0%2Fufw%2FSxwNhN5XjJyq2GDOORlwVD1l9GjA6qaTeo1GECAiGD5sA8hLhe7fzmB6jM7rSGFQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19afb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4505,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3830)","md5":"a634dd4ae46f0b3a29cb8913c45cd310","sha1":"1c6a3e63134727d4d567e9950d3dbdf34133c392","sha256":"0287185027f8ff6970c9713e52de9217cb08adb36f01b48913d5b52be9f4eb07","sha512":"773d8075346afe886ac59bdcb2790cdd4eab6ebddc6d823f82791d0e5115155eb441bc0b355d9551d9cf6ddd74f76094d7a286725c5d1344d2c256fc9dd7e40e","ssdeep":"96:x80Ae+70kGlaqxYMbOYMWorC1FguxuTlK4eL8ats:x8jqacYIcWoYK84/","tlshash":"609194a733d9497242dfd7d7a53a901d625060e9a4b8892c701fadab0734dc270a2b38","first_seen":"2025-11-14T02:09:21.945416Z","last_seen":"2026-04-08T19:10:30.727051Z","times_seen":30,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-19T23:56:08.335Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /if/flow/default-authentication-flow/?next=%2F HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mrwEWACnU0o1MUetgCuog6XZbIfZGWTgOI%2Fh62vehnhoO02%2FvkKUJOFbvteGxzTmdt3ZyHpRMIE2MiYzBKmG0qHpghIEfIaNzF6ib5uOc3avHQ%3D%3D\"}]}\r\ncontent-language: en\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\nvary: Accept-Encoding, Accept-Language, Cookie\r\nx-authentik-id: 53238b277bc0459aa0bc6b98482bdf08\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: authentik\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9b0ad5b81ef8b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4736,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (930)","md5":"4a88ebd6f29ba617103dbc376535794a","sha1":"d0dd4656ccadefe8285803bf493a4d8b43fc05bb","sha256":"d20f45aab676bb8a572ca8442e53da505c7c00a92a7592ed0fea51e249d8632e","sha512":"d8178d021ec83dbeeb0b877f2e44b4b2cc78075f5b759d34c1ad6e3b728cc811701c5f3fcdea8062f3d5350cb84f4702ca33a652a685200e898c6948283b16e2","ssdeep":"96:Q65fQfHQ6T3fNb0LB23sh4Li4z4qU6k8Gnx/IR:Q65ovQ67FbAB+phUqUrnx/k","tlshash":"b5a18321dae0683b729093e4dcb4bffe5ea1920bc5244898b19cc9609fd4ec54c775b9","first_seen":"2025-12-19T23:56:48.641647Z","last_seen":"2025-12-19T23:56:48.641647Z","times_seen":1,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/VOFWSFBX.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/VOFWSFBX.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 8783-72c2dadbd387816ab495c66245a1716f31378649\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kKoSd746vFaGKRRCm%2FycMxdP85eFFzpr7GQUlfXr761NhTsl%2FlC5QctLVS4IJ04JxppsrywTZvwlZFumo3IXGFOgYGzYVmHUiniVK2gxnmUyJA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0991b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8783,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (8745)","md5":"785af21cc0724ebac498304875ae8a45","sha1":"72c2dadbd387816ab495c66245a1716f31378649","sha256":"4be5e72a83b5ad1eab664d12775f04ac4762f7d773f6af27e4262cfb24539b09","sha512":"077a3bbe8b6b86672648b618f5d5b2e839ab2da15c166c8ebfbfab7618b08a43906672d0656c731665ab8f46a8aa6c87e535750641b964045fefbe1f390250ce","ssdeep":"192:zmWcTnzL0TebI18C7gK3jr9g57qsRNOANgejMYcfL0sJU0sC:1e57y3/9g57DRsANgYMYzg","tlshash":"d502a6947451ed778bdb52ca10bf0106e03d25dbe0984ca4ebcce9b626f1d2099bfb25","first_seen":"2025-11-09T11:09:19.630798Z","last_seen":"2026-04-08T19:10:30.721549Z","times_seen":42,"resource_available":true,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/VT355AOK.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/VT355AOK.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 183\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 189-d71a948df853aeeabf5dcf9d39684a24674d44d2\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4Itd0Ubyy%2BXwbS4BcheQOUxKk%2FWF%2FeI85n9zzg5wpP8eU0Gcvxxn1zJoN2kZ33b5XY6pHmTPG%2FLbZ1Xd6Jfdpyo4wGdYeXpteAvPb0QXtSjn1g%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19abb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":189,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"8222de10f38e7a17fa1dbb5b39f04acd","sha1":"d71a948df853aeeabf5dcf9d39684a24674d44d2","sha256":"569d08229511c320d8d958ea2cdfd87e37b924ff6398eaa6dc8efedcf25a4287","sha512":"4887eb176a54db16681c037ca98fe4743004dcb143d596cd77de62aaa2e5ccdad5ac16de1fb80ee8b1026ccddbeb967862b463d9a43e0103106b1a48df31b24d","ssdeep":"","tlshash":"30c0126a28716ffa681a057903199c072277b9f5685503ec5548d8b413aa069a639824","first_seen":"2025-11-14T02:09:21.954235Z","last_seen":"2026-04-08T19:10:30.728638Z","times_seen":41,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/CVDUBLCP.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/CVDUBLCP.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/standalone/loading/index-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 52051-8b2bc54d631548030ec7c79a73840be78edf6046\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eu0xFtNBmMkBfS1%2B1%2FpQpjkTBKCnsyBLrTXdudLNOPkv%2BEE%2BXAshU8lfRD51F7Si6uPYtVeWqE%2FRWXopHWw1GFeyAJBOL%2BpVL960GJgIefr03Q%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc39d6b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52051,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"a50e8a7aaf1293cfcaf257b157354fb6","sha1":"8b2bc54d631548030ec7c79a73840be78edf6046","sha256":"1c82d9dca0d192bae70dcdb74eb7ca19ffab2dbf86853f3d07a23ee763159e76","sha512":"792fdec1b83a766e898271676337b480bbda38dd1765b5715844c17b47f505c0b5ec63d35c14b7bcf779dbe5c9aaa1c6397c17c811aed32bc2b8cdf5842f19ca","ssdeep":"1536:HJe/mxCQ8zNUk5mvAYQ4B0wMx2Oqqb6s3qf5rF6UIZYRzpzOKRyDU0s8tUIoVKaY:O","tlshash":"3833de4112ffd1b424bfe3bef1cb92c85fbe17809a8999325968452319f83ad4f4164b","first_seen":"2025-06-24T21:11:18.02956Z","last_seen":"2026-04-08T19:10:30.729608Z","times_seen":215,"resource_available":true,"data":null}},"time_used":394,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":394,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/LCNAZTC3.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/LCNAZTC3.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 592\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1439-c974cca6dacac15f99477bad91b91695c805b2a0\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cAzN0bQfJWrKvsnXzHaPTb6ip7j8OWzMIw0InfTujPrtfJ9MeCENLqLOmBbOwVTInrvzYHruEscLTm9avSEZqwcQiKoEddsI7J0hnjxZP%2BTaGg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbf970b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1439,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (383)","md5":"3b91443c05caa3340c16e3e37a09959e","sha1":"c974cca6dacac15f99477bad91b91695c805b2a0","sha256":"447935e12168887bb47ed9e8ba1f8eae5db9c5412d8559b607f162b2691296f7","sha512":"eae192da7b2258ae1846a68be2cffa9301440da6d39587bd4e7b0c50f53bd5df2d802962e9915e211cb1287aff1807dfc799f8fb02d7befe616846260042b75a","ssdeep":"","tlshash":"2521800944e5c0ba046b8ae1d17527a74a3014a7835c91f8b2ed2fa15f51c86945faae","first_seen":"2025-11-09T11:09:19.464295Z","last_seen":"2026-04-08T19:10:30.709071Z","times_seen":31,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/AWRPPU3H.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/AWRPPU3H.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 914\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 5291-5533bb5b49c1075d96aeb5c2b5fa3de49573fa3b\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3tfQpi06YQmJJJjqI2RYUFmhfge9mm7MToyto7eeMupRGtaiteL3QSqX8LvMfatVRid8ToR0DFNWf84pthQ3D0Un%2FxF58M92cBzml1DJ4xIJvQ%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0993b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5291,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"eba95de720fca57c25ab94ed72c89c8e","sha1":"5533bb5b49c1075d96aeb5c2b5fa3de49573fa3b","sha256":"c2da689abc73c7546fa7a085ec589420c829259d97d257b8d654a4919e8f8eee","sha512":"14dd280da80cad0b63e7989d8d975c968b82f2e69887359b007d9f9e1234d628f9230e3678458ce15438c30d7d56b2a5c95f0e8b0ef28dfd93074d90e4b416b7","ssdeep":"48:JcrcWd30HBuCO2i+a9kAFY+0WlPvIzGg9xQiPCMwcQ+ui/42TiSNFEfhU2dU:DsGA++zxvIzGWxQOCBcQFi//TIy2dU","tlshash":"e7b1b720a8763076357fcbbd91fa870a2b5e304bcd0fd516056cd14a18ad3af573ae68","first_seen":"2025-06-24T21:11:18.009703Z","last_seen":"2026-04-10T14:05:59.714081Z","times_seen":229,"resource_available":true,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":225,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/34UXYDLT.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.981Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/34UXYDLT.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 465\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 847-533c1e61bd0af606c9157c5d50364fbcc0d2bc52\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JW7OGirSOOcQv%2FQy2A4NuA59%2BGpFzlP8qmF7kAjkdNHFaLipVcAWxYiWvqV5QfJ7lI3Y5xPkohM%2FmBqMWuTNWnlvh9iOm%2FyYD9hPozQaA3R9vA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc1997b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":847,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (809)","md5":"e8a862da3725802e23bc1422156ceadc","sha1":"533c1e61bd0af606c9157c5d50364fbcc0d2bc52","sha256":"1b7d72ce6344bd6fbb2624024e554df16a270d242fd6589edd4491ea9861cd44","sha512":"af7d3610de234bb5943ba3a6926881f6f5b1f3aa2dbe57709bf741f88080341a994b107dc512645324fc1f644ccbc56eb720b632be5f17e60993b9180783c330","ssdeep":"","tlshash":"6201595bb35452f5128688da98270d22f32162a806dc483cb19843f2d170a46d17bf72","first_seen":"2025-11-14T02:09:22.033575Z","last_seen":"2026-04-08T19:10:30.74322Z","times_seen":30,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/KH7NZZE5.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/KH7NZZE5.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 150\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 131-063016dcd20c64b630fbf570341885d584a5f522\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vmIiSW4MByeTM8dyB1ZEOUz%2F2MJ4ZYslQGhXwpBfUolyaVSiPoy0Y%2FBtEVe6N3zok%2BWvmuhncb2Gt0Wuu%2F5tDIe3h0AZayVCXhH8P7viBPxTmA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19a5b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":131,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text","md5":"894eee19b6031d5b9cc2741fbd66101f","sha1":"063016dcd20c64b630fbf570341885d584a5f522","sha256":"3f21cb8086d05289b9d7f8fc9fc92a84eee462c684ffcdbd5cf1764875326ab2","sha512":"5053148f5aa3077bbcd3fe8a939144e1a7d82d49341c80c2ee1ceff209a98bad4daa146bc36e356b899a6834d5ccb7f4e9f2f5201c990b9f67097ecf58ab3fc2","ssdeep":"","tlshash":"cec02bcfe5707bf500d388da803fec937125b0c06f0012c0910046b036304e24025c34","first_seen":"2025-11-14T02:09:22.015777Z","last_seen":"2026-04-08T19:10:30.713476Z","times_seen":41,"resource_available":true,"data":null}},"time_used":248,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":248,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F\r\nX-authentik-CSRF: \r\nbaggage: \r\nsentry-trace: \r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:11 GMT\r\ncontent-type: application/json\r\ncontent-length: 284\r\nallow: GET, POST, HEAD, OPTIONS\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncontent-language: en\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\nset-cookie: authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiIyZDV6Zzh3NG82aW11ODNld25nY3gxeHBvNTVhZ2l1diIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.ASjK_fw1Bbz4A3IrKYiyNtNNqb7ZnwXrNVYVNOvh0H8; HttpOnly; Path=/; SameSite=None; Secure\r\nvary: Accept-Encoding, Accept-Language, Cookie\r\nx-authentik-id: 125e64988b14424a8d1fce5b535334e9\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-powered-by: authentik\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RrP%2BqslFpy1r7ccIHJ84cCeEfmsw2gNiGNiSMpojEBPUJ5CMuUTkAo%2FVAJHEvUvlTIzuGPzxgamaaN1I78i%2FNU80pS9PWv9lvUR%2Bkr%2BwrLh2wA%3D%3D\"}]}\r\ncf-ray: 9b0ad5c17c92b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":464,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"bef6cdbb80ee81e6bd3b8cbab523c5a1","sha1":"0cb3b6168b1a4193789b056d51b04cc81dbd59bc","sha256":"0da1fddecb6d5298478dc3fa2fa5deee89eca78b598613a438e5e9eac51c0076","sha512":"887ff44e4ed494a24f5fc9442a4d30c400fe4582d7ea04eeeac64ee1d5a095c0d13aeb5924db921d3387b5465a13aa40231c355c4f6bc98a63e4abcedeba61a9","ssdeep":"","tlshash":"fcf05430c76118b73dd29220b3a552d26398c65dd7905d38c33d551f17adc7211d6f91","first_seen":"2025-08-03T20:40:44.917392Z","last_seen":"2026-02-13T22:43:46.455524Z","times_seen":43,"resource_available":false,"data":null}},"time_used":1695,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1695,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js?","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/d39f91d70ce1/main.js? HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-encoding: br\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=82Xf6Y6VDbPetFlzKvtf%2B%2F0pYJKJJ1oTE9tjhfBOXUb8%2BHjCuRI5PnSxva1tqmn7Si0xeEbZil0ADFUkAGxaap9l8ZAzX%2FZl%2F6F%2FBKId3dyT6UkWgXcoJYkCl1T7%2BTNiACwGqSKigQ%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 9b0ad5c1bcb4b4ed-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1396\u0026min_rtt=880\u0026rtt_var=191\u0026sent=706\u0026recv=377\u0026lost=0\u0026retrans=1\u0026sent_bytes=644728\u0026recv_bytes=8960\u0026delivery_rate=50366863\u0026cwnd=256\u0026unsent_bytes=0\u0026cid=51aedaa60604b1d2\u0026ts=2169\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10329,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (10329), with no line terminators","md5":"99c7ec3a422fe933f3bbe256383ac03a","sha1":"ae01fe34ed4645b4106d3fa5eb07bdab3544f5a0","sha256":"ec8141455b915340f3b2aadd136f290a5af56fc7c72beca3c5fa9e4924e8f114","sha512":"a346a32097514525a371bdf0f56fceb17162b1b5e13e3b7015114a3947ddb02fb26a040ad009575ee7107c92711dc1ea77a9ac2df2518669e8e952178db253db","ssdeep":"192:Hv4fazBltrcIf6i3c8okQS6CjPd80/oxaT3nPMvZCWlcM9MG9SED:P4faBlJcA6i3c8ok56Cbd80/oxaT3PoP","tlshash":"e322e68b3e4d79d610216021b00ba6ca6489ceddd41099819f02d5b4fb3ef26f9ebf4d","first_seen":"2025-12-19T23:56:48.64959Z","last_seen":"2025-12-20T00:24:36.595225Z","times_seen":8,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/3BX3KQSO.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/3BX3KQSO.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 16499-cf8661c6167207980c5fe2b60b6e7ddebab2a761\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2cNzgoilK8WtvvsG%2BMxHj7cJs0cKOeETmlWkgxQCqk632gpve4Pwo26M74xYb0XrsIBZM6OwvtIiyIY0rR%2BR6O%2ByCMQZt%2Fy8u59GhMDR0Qzdxw%3D%3D\"}]}\r\ncf-ray: 9b0ad5bbe969b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16499,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2763)","md5":"0951c41e9c7e6bf9622b7fe0a1b66688","sha1":"cf8661c6167207980c5fe2b60b6e7ddebab2a761","sha256":"45acf4a7d66d2a6e460ec1f2fcd610782b66a986a218e8da75d6e5a57a7af11b","sha512":"518e12a4f5265abaa1c2cc4c09f2f7810e395eea8bcdb86bc8006c19ef3982e80a9b63361aa9a8e4a4b6b1ff7ab9d96ac2df82e5bd725403cda842b1473e22e0","ssdeep":"384:bb6+idldq6h/sLaFOoqc2s35OgwgRvbaNlT4rXfrX6rXGbg6E:bfmr/E","tlshash":"7772c66161a158778b4747b2cb8306821730065e888c64fcbbec75e61fa4c5991abfbf","first_seen":"2025-12-19T23:56:48.650579Z","last_seen":"2026-03-15T23:51:01.053337Z","times_seen":6,"resource_available":true,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/35WT7OUR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/35WT7OUR.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1227\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 2541-c8cae1baf29d38982d1e07fcd1bb64e98074bc80\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iSnpbTsh0Ar%2BD5QChRxGM8GWQzCAzAL3GBMMeREq%2BhSjwh0Tmrl%2B6XBKSAIMoF9uLDj8UIfsiTH%2BlFAZzvL4no5Bf9daGcmUDcINm%2FDwHmYjtA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19a7b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2541,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2503)","md5":"582bf8342a7f42c4c1d3f40d59fcad3b","sha1":"c8cae1baf29d38982d1e07fcd1bb64e98074bc80","sha256":"8a0a500560c44833bad17e55b5d16f2cc66945c6c00cfd0e19690b481f9d3e93","sha512":"5729ad8df6a4867c25d40f45029df7a37d14698e41dccd9f105bacea7823f13750c845a12a55c1e4c576c6de265b3034892fb0134d1c5ab6fb02a576c381a599","ssdeep":"","tlshash":"a55160cfd1839133dbed859acc6311129225085c811fceb4ae6bcef1025864ea7d7b7a","first_seen":"2025-12-19T23:56:48.651414Z","last_seen":"2026-03-15T23:51:01.056654Z","times_seen":6,"resource_available":true,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-19T23:56:07.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Fri, 19 Dec 2025 23:56:08 GMT\r\ncontent-type: text/html; charset=utf-8\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cXalE6QBraaKI3HO0PLF2auek1cg%2BcOaLmDGzmM4jn9%2BTfMK5GeqESopU%2F%2BvzZzc6m3F8kooxbIoBtPKu55kSLsZO1n84Mb7h5NJ7IraZMhsUg%3D%3D\"}]}\r\ncontent-language: en\r\nlocation: /flows/-/default/authentication/?next=/\r\nreferrer-policy: same-origin\r\nserver: cloudflare\r\nvary: Accept-Encoding, Accept-Language, Cookie\r\nx-authentik-id: 233aa0aa2b844909a6d50f5369d65ba3\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\nx-powered-by: authentik\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b0ad5b44cf0b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4736,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-12T12:55:59.554947Z","times_seen":13662418,"resource_available":true,"data":null}},"time_used":382,"timings":{"blocked":18,"dns":0,"connect":2,"send":0,"wait":346,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/TVZIPPAC.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/TVZIPPAC.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 402\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 607-3a40c6fb1ef7f1d76e0f9b9cf0c8b7b785c5f1c7\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XDdiGvr2C3kmu5lAng9oQolDqvC2rAlhFJP2ftnSc0w3nVHE1rgNgSfseHfmOU91%2F96JPMHeoHYdkB845e5KrnZksOzivTPoMJVEEalnejrl4w%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc0986b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":607,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (569)","md5":"f8fff07d9ec9102878f3152b02a64ebc","sha1":"3a40c6fb1ef7f1d76e0f9b9cf0c8b7b785c5f1c7","sha256":"56dd930b8e47ce5eeb9ba3edf168fa1af2b6ea06a67d7365bd21df3bd134eea1","sha512":"d5f8e4b38bf123ed1313483b64948d6a65256e7ca49911e47a2bdc7b46669a9246918195d37f022fcfbf05d9438b3f1e18d7e34f382618b2b13b5f533a5616c1","ssdeep":"","tlshash":"ebf002c77082727ba52345ab4c7a03011a5e14489a095668221477e3927c5d15325f6b","first_seen":"2025-11-09T11:09:19.638113Z","last_seen":"2026-04-08T19:10:30.729145Z","times_seen":31,"resource_available":true,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/K7CAZJZM.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/K7CAZJZM.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 31165-519db55d111c51a984c1db1fa004442004b9ded8\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PCa5iR%2BLsu1fIbJ8jkuXe4KiKFXHcUCmaEfxHQcF202DXm6Saw1VvARsL7b7rZQjcS0ek2lZ9ZlE9FNSNdB60Oe62pxQeOnQ1aby8UMAlLnz1A%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc1995b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31165,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (1023)","md5":"4c909540d449ad34113aa880d692e53b","sha1":"519db55d111c51a984c1db1fa004442004b9ded8","sha256":"6360d82cb78c61c119431838b862210d1877d681da23fd53fb28b5b6d18b1635","sha512":"be04a45a280ef4f031ec4dabf79e955eff8b3241dfd5df50b61ba981199aaa95ae0e2693c5c98dd40f8080c7ed304483b5913208a28009717ffb7d344da0be16","ssdeep":"192:Qtck3sOgYWGC9AJwk4dVEt9RPtInQUTFmnIRhmHIv9mPIhrL8EKTJONWSRQ/mRba:gtheQcb3Ijzt/8A","tlshash":"28e20940147a427636bfdf7e73e98745136868a0c894859f3cb87a931aedeba31137d0","first_seen":"2025-06-24T21:11:18.010962Z","last_seen":"2026-04-08T19:10:30.706835Z","times_seen":211,"resource_available":true,"data":null}},"time_used":234,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":234,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/QT2F33W7.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/QT2F33W7.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1735\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 11533-d13c19ab700951a882d266e004c7b1d95b0439f7\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3%2FvNBFY2U71%2Fik0eHgZoxPvPS5WXEmkoPdrl9mLoM3uHYsEDJ1VKnEFIW3CsIk1%2FDCgkO9DoOuLunGxZKuRnJak4Zo2nbhKuZQ4ENsDJrEYRCg%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19a4b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11533,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"5aa4469f9bdd1a5e95c495c9d90db483","sha1":"d13c19ab700951a882d266e004c7b1d95b0439f7","sha256":"0de295cc9950643728f280886380e756b9f2b0f4671b22ee915714374178bdd4","sha512":"24647557622440d225a417dd7bdd8a5b01febcc07182c79075458433baabf9de9fa50bb73c213a067547f2e0ded0320554dd345c7e2895293bde287f1c3ddc53","ssdeep":"96:5o14SmXLJIL/iL9nIFOcqK/OBGdAPtjhjX5SxYOrUHnlaCcWHOI2TzM:aFqLuFOl/HDCYOmtwzM","tlshash":"e532fc40287a6df7672fd7be51af520c63b934c3884accd048be461e6f65bae62121d4","first_seen":"2025-06-24T21:11:18.015545Z","last_seen":"2026-04-10T14:05:59.664462Z","times_seen":227,"resource_available":true,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/F5NDAKRD.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.991Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/F5NDAKRD.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1847845-450077395b124374094a67e04740e9f676f0ce29\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LS5t%2FYeeH4jcgOycbmzU3GfiqnEFNdVaRL%2Bfpz6XeRVVckMGFsGEi3bIId%2FAnfbG65ASmz1TTEjjD5YJZLTUTLvNA6CX9055lTzJ7b6SLZBgJA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c6b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1847845,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e5d42b0982e7ea552a88c18e5a6e2de2","sha1":"1136f39e943288385bbb142166868a4bbe0f479f","sha256":"d5c081a7f7eeb0c55ef5528f1044bc4c9d81983201bb16cf5fb62973b9b9ce53","sha512":"10976d76f4c71faabb9c28fa418713de8588de3432d3a1f061a9257cd96507d024d3119f15d1a8ff5c5292a786a7a13ab764019d76af0cf09a5a7a62753f4d28","ssdeep":"6144:bGqHble16AXfrGD8Au0KCVq2Yam2mqgECW9ZZQ5FH8I6+0ML+jO4Xu/blTkK0c6:C316mrW8Au0KCVqCt90rL+jybEc6","tlshash":"0525e9e9bb7e7912a38b8975d8770303e2795065a02c9024767d99fa370150ac33fe7b","first_seen":"2025-11-14T02:09:21.906418Z","last_seen":"2026-04-08T19:10:30.703163Z","times_seen":30,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":545,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/4V5RU7AR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/4V5RU7AR.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1154\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 7265-b7d550574df18055bfb0c2847a6524657648a822\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K0CBS%2Brj0n64y9G2WvwUs1G1Y1B0ZXnbAggBGSVvM2pJatx08XQ1vec%2BhdhDtMLHJjLt5GHA%2Fq03m3kmkWTQPC%2FoxtbboSpjgy34qsgvh55R1g%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c5b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7265,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"b5e70375a93a4380bdc9fa4fd7100226","sha1":"b7d550574df18055bfb0c2847a6524657648a822","sha256":"231736d6546ded76e37a6b592a6eab764ba23d0520ea8e25a16eb8bce9b15bfa","sha512":"1a40245183352ef351947b7268698c0da0507bb5f4ca7faa719d1b453b17d0436523c864991524eee2e5ec9de4d2bc538f2a9f7f08aee02921ef0820798239f7","ssdeep":"192:DZwPZEXZt/sXPuoqYnvZeThn01DgitEpgZkVXM5FNHMLFm/5ZEXNPoo4YRv4W+cP:DZwPZEXZt/sXPuoqYnvZeThn01Drl/5+","tlshash":"16e10544187e4d71562fd3f9914a0708a67ce8c14b3ad85516fd120e0dbab7d53be35c","first_seen":"2025-06-24T21:11:18.000831Z","last_seen":"2026-04-10T14:05:59.670339Z","times_seen":227,"resource_available":true,"data":null}},"time_used":379,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":379,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"authentik.error-reporting.a7k.io/api/4504163677503489/envelope/?sentry_version=7\u0026sentry_key=151ba72610234c4c97c5bcff4e1cffd8\u0026sentry_client=sentry.javascript.browser%2F10.20.0","fqdn":"authentik.error-reporting.a7k.io","domain":"a7k.io","tld":"io"},"ip":{"addr":"172.67.186.116","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:09.795Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"authentik.error-reporting.a7k.io","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 05 Dec 2025 19:01:50 GMT","end":"Thu, 05 Mar 2026 20:01:48 GMT"},"fingerprint":{"sha1":"41:7A:BD:DF:37:94:DB:61:E9:26:49:E8:67:A4:C9:B2:11:83:E6:AB","sha256":"B0:44:85:89:F1:9A:02:BF:F5:5C:56:D3:45:F2:49:E5:79:92:0F:2D:F4:A4:10:E3:ED:7E:BE:E5:A9:C0:C9:00"}}},"request":{"raw":"POST /api/4504163677503489/envelope/?sentry_version=7\u0026sentry_key=151ba72610234c4c97c5bcff4e1cffd8\u0026sentry_client=sentry.javascript.browser%2F10.20.0 HTTP/1.1\r\nHost: authentik.error-reporting.a7k.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 439\r\nOrigin: https://sso.gsh-services.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":439,"data":"{\"sent_at\":\"2025-12-19T23:56:09.793Z\",\"sdk\":{\"name\":\"sentry.javascript.browser\",\"version\":\"10.20.0\"}}\n{\"type\":\"session\"}\n{\"sid\":\"7efdd8857a7341cf8586661339068dab\",\"init\":true,\"started\":\"2025-12-19T23:56:09.793Z\",\"timestamp\":\"2025-12-19T23:56:09.793Z\",\"status\":\"ok\",\"errors\":0,\"attrs\":{\"release\":\"authentik@2025.10.3\",\"environment\":\"customer\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}}"}},"response":{"raw":"HTTP/2 503 Service Unavailable\r\ndate: Fri, 19 Dec 2025 23:56:14 GMT\r\ncontent-type: text/html\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization\r\naccess-control-max-age: 1728000\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e4LY3q5yxWChCukVMG7Y1oaBNd1OKmscobCN%2B0VyMKsiFCoV%2FWdYkYL9HWKVdoqSoa9IOtp6noRZV%2F30%2BTw%2BRBak0Y%2FJA2mFKGFn5bZ5emioxcy8cmsoRo640SiaJQ%3D%3D\"}]}\r\nserver: cloudflare\r\ncf-ray: 9b0ad5e15b9eb521-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"503","status_text":"Service Unavailable","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":190,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"3267dd8f0e96711dd54dbb1f5676b447","sha1":"202602c4ec4a5e2498e3d24a3ed025ce70bf749c","sha256":"b429e25e7813a9e2b90dcec11d9cb5287751246128dd6c76a7349774829c5554","sha512":"e600bc9f41fffc28854805387f485a578dc4b0ff354ddc5868040952ca6d902ffad9123304e0c1d8b698925caf0d8544a90f2ec3c8b6d6dfb9d258c528c6904e","ssdeep":"","tlshash":"acc012eb38823cadd4e3313d28c36a98f29081ec14f8611001a05f2372cb296afc3b13","first_seen":"2023-04-05T16:44:06Z","last_seen":"2026-04-12T10:30:22.685078Z","times_seen":3793,"resource_available":true,"data":null}},"time_used":10323,"timings":{"blocked":5136,"dns":5124,"connect":1,"send":0,"wait":51,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/T7AW6YFM.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/T7AW6YFM.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 755\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1375-c5d95d05d35dd5d4df9ab90149178a14e9f6688a\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gLn1xGEsrlLDfInCVon2enpQcPFzMaEeGn6V%2BzrDtACKtqwDrJlnaN8gmLINgnRAml0DTwnZ06ESJ33qiuRmGUEN3DtC7vRZJp1HPVjdSRClTA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc098fb4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1375,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1337)","md5":"f613e16f40758598413fa96de7a29b08","sha1":"c5d95d05d35dd5d4df9ab90149178a14e9f6688a","sha256":"ea1fe612d2c635e87463979233c56480a97a0e4882045e4bb69384bb438adcb8","sha512":"1203547511d93f784d35857015482c03630018243cdb839d5f3d56f5a6298defefef4f5c57bb9f4bb56bd76838891c945e803c196cf19c02a3de6ff8d314fcd5","ssdeep":"","tlshash":"0c2111a72ab87bb94ff888d64836c4a173e1d4b993ad1c64d618376b1150843c0d3f22","first_seen":"2025-11-26T19:07:07.884765Z","last_seen":"2026-03-15T23:51:01.077223Z","times_seen":7,"resource_available":true,"data":null}},"time_used":226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":226,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/ULQE7QTR.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.985Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/ULQE7QTR.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 671\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 1144-9bb086551f8d65562c758bcf8c12f092fdd5ea81\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z0vDEpMqXp7u%2F8oVitUuQKJwaR21nxeTZ5tw49f804RHCj1DrR583xOGJf%2BuNx0tiFD%2BP3cWvy%2BJB5QBzTMRU7qEZhq0Tpcoew6Mf1atM%2FCPcA%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19b2b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1144,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1106)","md5":"4c76517456de5775c9015e90df707c2c","sha1":"9bb086551f8d65562c758bcf8c12f092fdd5ea81","sha256":"d29827bc2ff7db85b2efb5a7d8de6fec8c71eba65e3564ddd5a7908703c8515f","sha512":"3d66034ee307fb5f5fa8c1fbf8035c680090b0d5cde3fd888f338feba627010c96d8e912cb6086b288bc9752f1bfc6215853877501f0428cf2b4c7778a18fac6","ssdeep":"","tlshash":"1f21005333aef93b41ee815269318093b34160d8b0ed056cb97c71d72529d95d1fdb3a","first_seen":"2025-11-14T02:09:21.917308Z","last_seen":"2026-04-08T19:10:30.73247Z","times_seen":41,"resource_available":true,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sso.gsh-services.com/static/dist/chunks/XW2HY2O2.js","fqdn":"sso.gsh-services.com","domain":"gsh-services.com","tld":"com"},"ip":{"addr":"104.21.68.174","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sso.gsh-services.com/if/flow/default-authentication-flow/?next=%2F","date":"2025-12-19T23:56:08.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gsh-services.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 17:01:10 GMT","end":"Tue, 27 Jan 2026 17:51:51 GMT"},"fingerprint":{"sha1":"2F:0F:2E:09:91:39:6D:92:7D:2F:88:D2:34:32:34:14:4E:B4:3B:3D","sha256":"17:3D:64:E6:23:87:61:F9:43:E2:2A:E3:4A:8C:1E:14:38:CA:97:BC:48:2C:B0:A9:6E:BF:86:A8:3A:FD:E5:F0"}}},"request":{"raw":"GET /static/dist/chunks/XW2HY2O2.js HTTP/1.1\r\nHost: sso.gsh-services.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://sso.gsh-services.com/static/dist/flow/FlowInterface-2025.10.3.js\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 23:56:09 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 120\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=86400\r\ncache-control: public, max-age=14400, no-transform\r\ncontent-encoding: gzip\r\netag: 101-e45d1c2798b4932f93ee979d09e48797028072e4\r\nlast-modified: Tue, 16 Dec 2025 18:06:38 GMT\r\nserver: cloudflare\r\nvary: X-authentik-version, Etag, accept-encoding\r\nx-authentik-version: 2025.10.3\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JQJ3zr7hgG3r%2BL5uGZ5O7qDDCxKb1ZleoqdaO9YQTAnYVlhSTv7cLWolZch6OsexIy%2FZI8f6e8z643cLjHZpKu5bW%2FSQoGFBrwXiT615k7BH3w%3D%3D\"}]}\r\ncf-ray: 9b0ad5bc19c1b4ed-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":101,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"Java source, ASCII text","md5":"b4ee969f005f6348366e35105be13231","sha1":"e45d1c2798b4932f93ee979d09e48797028072e4","sha256":"d24cab07f0eaad4e00d869387c822657ce5877ae9123ac0b888ab66ba4a20a17","sha512":"06db5ea9868522279b646d7ae0a9b53d49aa228d62462a2de514ac74a8a31c42c5504161c75cac8769037953e24cf0f88c264690fff633a6aa8e77f0d2b1b47b","ssdeep":"","tlshash":"e2b012578cf869f458d70cdd505a9d83452410e9a75132c06010662412314c6d10ac22","first_seen":"2025-11-14T02:09:21.992184Z","last_seen":"2026-04-08T19:10:30.707368Z","times_seen":41,"resource_available":true,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"sso.gsh-services.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}