{"report_id":"bb07fc8a-a016-49d8-8efa-e8bb2556e44b","version":6,"status":"done","tags":[],"date":"2025-10-07T05:14:08Z","url":{"schema":"http","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":0,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"final":{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"title":"GET-X"},"submit":{"url":{"schema":"http","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":0,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-11T05:14:08Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":10}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"ssogtx01.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"gs.jdwqqi.site","ip":{"addr":"91.215.43.62","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"domain_registered":"2022-07-06","domain_rank":0,"first_seen":"2023-10-27T17:21:41Z","last_seen":"2025-10-04T05:10:42.679897Z","alert_count":0,"request_count":1,"received_data":759,"sent_data":597,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}]},{"fqdn":"us.i.posthog.com","ip":{"addr":"3.216.175.216","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2020-01-23","domain_rank":42193,"first_seen":"2024-02-22T12:48:36Z","last_seen":"2025-10-06T17:57:06.111748Z","alert_count":0,"request_count":4,"received_data":2480,"sent_data":2083,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.250.74.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2025-10-05T22:12:06.955348Z","alert_count":0,"request_count":2,"received_data":1114,"sent_data":1714,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ssogtx01.cc","ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"2025-01-13","domain_rank":760426,"first_seen":"2025-03-26T02:25:04.976918Z","last_seen":"2025-10-04T05:10:42.19715Z","alert_count":1,"request_count":1,"received_data":405263,"sent_data":575,"comment":"","tags":null,"fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.gwdt26x.life","ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-10-07T05:14:13.702842Z","last_seen":"2025-10-07T05:14:13.702842Z","alert_count":353,"request_count":118,"received_data":5719353,"sent_data":123875,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.74.72","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2025-10-05T22:12:07.052692Z","alert_count":0,"request_count":3,"received_data":763891,"sent_data":1439,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"licensing.gaming-curacao.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2013-09-13","domain_rank":5874765,"first_seen":"2019-05-08T08:27:38Z","last_seen":"2025-10-04T05:10:42.640734Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":592,"comment":"","tags":null,"fingerprints":null},{"fqdn":"gx.webim.ru","ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"domain_registered":"2006-09-29","domain_rank":0,"first_seen":"2024-01-26T10:34:55Z","last_seen":"2025-10-04T05:10:42.063227Z","alert_count":0,"request_count":15,"received_data":1751181,"sent_data":6951,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"api.gwdt26x.life","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":36,"request_count":12,"received_data":0,"sent_data":5907,"comment":"","tags":null,"fingerprints":null},{"fqdn":"gwdt26x.life","ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":3,"request_count":1,"received_data":1546,"sent_data":471,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.gstatic.com","ip":{"addr":"142.250.74.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":146047,"first_seen":"2012-05-29T15:36:17Z","last_seen":"2025-10-05T22:12:07.360997Z","alert_count":0,"request_count":2,"received_data":1642346,"sent_data":992,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C72coOWc.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"f3bc6cd8453440a2112d76ab82bf7bfd","sha1":"af19e1d374dc436237a39c274cc7162326a03096","sha256":"d2f31fedab9f60c9f48cc734c847add5835557c2d4aacbccc3d1ed8794562a8f","sha512":"7f68ed63cfcda6c55de267e2e26029838317ccf504652ff4c2659492711864100aa52eb5722688d7d6a65efef4897edf1bb6a1d9c8e4cbdf225971f1b8ac00f4","ssdeep":"","tlshash":"ec21fe4fd000d03941aa8df8e069a92163b352ef03e9d6b5d2ee0e750b80025c14db1b","size":1390,"data":"","first_seen":"2025-10-04T05:11:03.629959Z","last_seen":"2025-10-07T18:16:30.085382Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-VRDLWS0SHC\u0026cx=c\u0026gtm=4e5a60h2","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8a2b932b886c9f345a4e647f2b76688","sha1":"fb0b7b57a0a35a61c6a8621f032dfd3b97ac9cf6","sha256":"a4430b253aa8a03c204d4ef19c9e813b7a321fc9682441f53141d2b202ae274f","sha512":"a41e5ad03eb037929975865d47c7499d3666f0d3a2ac10ef7f8ee35359f070b62fc918887f35f5bde2559467c7cc2c70e243585435b28d8ae60a14899907ce9e","ssdeep":"6144:ARxhrv4FZtfctlQR/cBWAc7zfdkpbbnWOUqgwLMP:Cb4FZtfLRPK0","tlshash":"7d8418ce73d670225396b478503f018ba57b28a2f44cc899f189dde52e74a9a4237f7c","size":375596,"data":"","first_seen":"2025-10-07T05:14:26.73206Z","last_seen":"2025-10-07T05:14:26.73206Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CFU304S8.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"65b0cca89e40818f39fdd7753db6d142","sha1":"24e169a25a2e5e795d2ba4918ad600ab939bc23a","sha256":"261a0d9b3884cb4797de2dd31290199dbcec4f295a6ca9ee2c3b48ab9d9651ce","sha512":"e4c57b7230da955929c01aa05a22c6039a4ab395d6480587e21169106ce56e84aa99238c37d03c5944a72a6c799d55cc072ee59b5e498caf41fd1f6e021b43be","ssdeep":"","tlshash":"53b092d6728a3ce12602b810a15b80b4a131e6240b8a47208026f08739724a48a52e38","size":120,"data":"","first_seen":"2024-12-07T17:14:43.577967Z","last_seen":"2026-08-04T09:28:00.148891Z","times_seen":102,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DzVxT-JT.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"56b248e4197f0aa4ff0bf9e1a5b45b46","sha1":"fd106eaaf3c02a1a9fd4885d893bd1970db2897e","sha256":"636935d6e62f931bc653ce0b948508d6b13dd6967c2b278ebc0cf8e81016773b","sha512":"cba0682b45dea2fdd1828dbc2d87bc1caa950b6f1a3837281662cf896660c76c8c5560bd9f60302bf997691a60509971c61b5cdf8d7d307ee589da79f2fd3133","ssdeep":"768:4qTY+itM+orCjJJy1ee3JP6r1KCcKlyUW7YC6u64tH/9:jbiJou3CP6YhcW","tlshash":"a6f21a487be0bc34c29a30d7353e09057b726641586f6600e009c6b97fa968a71bef7e","size":36459,"data":"","first_seen":"2025-10-04T05:11:03.531109Z","last_seen":"2025-10-07T18:16:30.074352Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DxTym_EP.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"a86bd43371591230ada5d1456dab8aa0","sha1":"b63e835649ce8bec3af500a596a7a1f58272afb2","sha256":"23ec8c94b2d36cce2ca68ad1e07e75f81b886d3d0077acde44ee2f5981e3ca10","sha512":"c2f22c55f07b8c50d90c20493fc7dc2b4ed68615b8adca2c23cbb0c8439285544b86a623e919ed65f23f8dd6202d553dab85551ce8953e3e9c963b24ff059899","ssdeep":"96:oeyq53hKMoKMj1W3FdeF31f5HnPx1oRstVCBR4Ir8Dtgjiby+qUECPRv5:o83BY1W3eFFvmQVCkIgJbtD","tlshash":"f5b1a7e4b1d9e09bb7b64fd1c032225260076ba57434f0d0f27aad73215be54a562b3f","size":5164,"data":"","first_seen":"2025-10-04T05:11:03.300471Z","last_seen":"2025-10-07T18:16:30.054069Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BbqPNdSU.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"d41b27ae63a30ec5d67cd47eabe3049e","sha1":"d1c10551d8dc1c36a70afbd414a0536cf64bc8b5","sha256":"d15f6a0302235ea1ec65d60e9c153f9edaf3344ac40599380885512fe83dea5c","sha512":"44f9246dede1ff1a1665f88dd0042c43ecefd28cf64dc01d4b34d60c88b6fa95255cf0185582c3c23a88f8edd54fb01d8e47576c7aca101ebc167b8de3f2b05f","ssdeep":"192:tXiFojMIZjkItgj6pnaJe/HA9iReMDjHMtpgCtAoRXSAd55rD1W55Jr0UWip8W4a:xiCMIZjy0LhYRHMAhPMN07i6jC","tlshash":"1c0240de520a64b00bd706fa81e846d0d6b00844f04d997c64f8dddf477ec8917a6bbe","size":8647,"data":"","first_seen":"2025-10-04T05:11:03.58126Z","last_seen":"2025-10-07T18:16:30.056453Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/TaNftZks.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"b3207d6a426c185b2a7c5287a16b3b54","sha1":"ef943c31a4709da3cb206379185f4a9298596fc1","sha256":"e5961afbf67e5c460e4a76fbab2ea44d2c538589da9053ecf5ddcb80bd9f16ad","sha512":"6459689b5cdc1c610512d2f364f44c886d41e88ea43170f86b80d8c876b31bb8af2ffa391565414c9827d27b907f8c96fbb043ba29325403b4f764686892c940","ssdeep":"768:ouDRAWjwR2qMm7t58Om4uSyMUWLucH4YrjjiYHNzlchq15lDVtkIfrH5J1Le6VjT:o7eDmpiSyMUWLucH4YrTlcWRf7HuK0de","tlshash":"00f2d709e4199c3ed9b78dd878541402722d2fdfd0804d72a2fc9e155bbbd78229eb6c","size":36888,"data":"","first_seen":"2025-10-04T05:11:03.548498Z","last_seen":"2025-10-07T18:16:30.09333Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DXFcmPY7.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"f35775ff648ec6716f2a297601310e96","sha1":"7305e85cbb919d8b85f3a5930e3f296b5e6fa785","sha256":"4511ce05d79359267133ee9e7e89fe59be13436a70679dacdf294e07de1bdc6d","sha512":"c81450c578ff1a8ef035a1d56429dd637b3533bde838720faf99a48ee0d1805b8f24567ecb757ca921606067907d517d04226b17383e91d3a37c4fce563a34f5","ssdeep":"192:XqsxSEFu6ZufGq++k5q2IkZQ+tOWwYpsTctY0ipgNE7oVKRpnKFEN:XhZ8fK+kQ2IkDLwYpfYZplOKRpnv","tlshash":"c212e9e473ac72aa59630dd12475481de434e6243b26f4d1f2ba38bab497c44b273f2d","size":9180,"data":"","first_seen":"2025-10-04T05:11:03.241006Z","last_seen":"2025-10-07T18:16:30.134044Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C72coOWc.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"f3bc6cd8453440a2112d76ab82bf7bfd","sha1":"af19e1d374dc436237a39c274cc7162326a03096","sha256":"d2f31fedab9f60c9f48cc734c847add5835557c2d4aacbccc3d1ed8794562a8f","sha512":"7f68ed63cfcda6c55de267e2e26029838317ccf504652ff4c2659492711864100aa52eb5722688d7d6a65efef4897edf1bb6a1d9c8e4cbdf225971f1b8ac00f4","ssdeep":"","tlshash":"ec21fe4fd000d03941aa8df8e069a92163b352ef03e9d6b5d2ee0e750b80025c14db1b","size":1390,"data":"","first_seen":"2025-10-04T05:11:03.629959Z","last_seen":"2025-10-07T18:16:30.085382Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C28Ks5WD.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"226f97aae05b1bc8517bf6e8357b2035","sha1":"ec26d9e8486f92c5be054c7bbb23c607efc40016","sha256":"3a540feffb54425661775040e9d000fc91c8541e60a10d28b4916048e20d7c69","sha512":"a3f3fe091a35f13546658cfc513bdb66fc91a4fc90794d5ddfb88b64b6291a59029695134bac483280d8e88206b6497415122e156c68d87abd6a8324435c4057","ssdeep":"1536:7oDsoGxvPYALxa1k9CdeIusU1aCrhquwRpeQIvkn459rS90dBuwRp0r1GcJwdAfH:zZxvPY0L9sMawdAfGvM","tlshash":"03247daee38690fde12b8794a44b381431752ffea681cc8381fc5d0466268fc57ede65","size":214915,"data":"","first_seen":"2025-10-04T05:11:03.298502Z","last_seen":"2025-10-07T18:16:30.073415Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/pwa-load-event.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"f463b05f25296c1e185cc82087291f6e","sha1":"d15dfa009eaeeaaf36af83b20ace25714adbc583","sha256":"3f5bcf295bac81715b4413d640843ee19600f6a17c96503038c6a4193c331865","sha512":"5ecd0baa189383e24afadcbe391266fac63cdcdcb7da68ab1371168fae81f05f0140b4dcd86bc4cc59f4ebb3f5949e94b302f05de00942886fe3060436ae03bc","ssdeep":"","tlshash":"64e02b7483fc55b808e182b75f47bb15116721a77068d990c1871906f8d148780a2fd2","size":375,"data":"","first_seen":"2024-08-19T15:07:41.99372Z","last_seen":"2026-04-15T02:03:05.836861Z","times_seen":94,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/TaNftZks.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"b3207d6a426c185b2a7c5287a16b3b54","sha1":"ef943c31a4709da3cb206379185f4a9298596fc1","sha256":"e5961afbf67e5c460e4a76fbab2ea44d2c538589da9053ecf5ddcb80bd9f16ad","sha512":"6459689b5cdc1c610512d2f364f44c886d41e88ea43170f86b80d8c876b31bb8af2ffa391565414c9827d27b907f8c96fbb043ba29325403b4f764686892c940","ssdeep":"768:ouDRAWjwR2qMm7t58Om4uSyMUWLucH4YrjjiYHNzlchq15lDVtkIfrH5J1Le6VjT:o7eDmpiSyMUWLucH4YrTlcWRf7HuK0de","tlshash":"00f2d709e4199c3ed9b78dd878541402722d2fdfd0804d72a2fc9e155bbbd78229eb6c","size":36888,"data":"","first_seen":"2025-10-04T05:11:03.548498Z","last_seen":"2025-10-07T18:16:30.09333Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"243dcbbab1864ae304323accde3f63e0","sha1":"7ac807de29469c5e810042601c8a11bf3601b893","sha256":"43ebc8eaf80b1efe8dd36390371da196ac1ee2ce30e3210b583a7adf20335fda","sha512":"2d9905ef903fe79fb3c24a2c552599dfaab246622edd7dc9348fd4d593e0351166cbbf59d306849c6601839c6198884f1fc600ae9e0728ea7f26cc363c58343a","ssdeep":"","tlshash":"d8a011802022a8030aa8800c022bbb003a38abb0a280022082308208300a023280a388","size":77,"data":"","first_seen":"2025-10-04T05:11:03.69028Z","last_seen":"2026-02-04T12:10:15.553292Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b7ffd5b7408c1219fbd35dd53208e70","sha1":"87db90852ceaf58be691a8c2492353a5d76de059","sha256":"fb997fc9d5069092971ad25f0131258ced2c36bf9d313ad535de25ac5c36e70c","sha512":"4045a6bb31e36cdcd5d0d32b3a672004365bfe391ea66b11bf2d2ee96e2715105255f02bf2b442072b902e9f0ba7db465a5d4733ddf3b18378375de86f112d8f","ssdeep":"","tlshash":"633126cab36189126a97383b653b5344617326e61e0268a3f2260e447c2cadbd53375d","size":1677,"data":"","first_seen":"2025-08-09T06:39:59.161093Z","last_seen":"2026-03-24T20:06:00.342299Z","times_seen":47,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ls-cdn.amplitude/plugin-session-replay-browser-1.4.0-min.js.gz","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c19b1b5d91c8d683b1310562d9c4a225","sha1":"4d45dcac5c6a88e10052f4e356b2170c20413441","sha256":"bb5779145f1ebdcdee053876a4ed060174dda4656978972304c79ddd5f36dac4","sha512":"3a4e8d2e8f5d9a3b45c08ce99374c149a5b67d04d016edfe6259dfbbba948a049301c0cfa5f9bf334cb93b9b4a3558cffa725c166a943c90834c8d2237a1a21c","ssdeep":"1536:Ask/3qTBpVX0Ib6vhb2pJkuppl5METErM2jnpkDtoT1JaM18PIQunrr9gltn2BE/:IqBfX046vhb2pKMQt1Jawi697w","tlshash":"4ec329deb397b033539355a980bb0101b73a6a19300d4464f62ad9ea3c7d847a277fbd","size":126923,"data":"","first_seen":"2025-08-09T06:39:58.991299Z","last_seen":"2026-03-24T13:49:06.781634Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Br1FBsO3.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"767f58379d7921f95c8dc6c600a3df03","sha1":"13505dd414f4a7979cc3098535dd88e1e1ce193e","sha256":"fa877f9e586ac8365282757cb02e92b352649b7ee3f6cb33eb0026bb4f1c95e9","sha512":"57b4279a8e6d24ffa4bd77e6812666ea155eca8cb4fc3c1de0b42259393b937babb44298e1a70c2910ef36fbfc356c2e4aa32b36583304980a9e2f2fb98062f9","ssdeep":"","tlshash":"9611ce2bfa4a1b6263331c7646a931e6cf650b8b2c7994c43c54df261237c83e5a6f54","size":1029,"data":"","first_seen":"2025-10-04T05:11:03.632172Z","last_seen":"2025-10-07T18:16:30.14286Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer/v1/analytics-js/snippet/233e4c5f9379d04ec864/analytics.min.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"009ba376452e3bdba0f98538c0575d44","sha1":"7fc6cb65590b122da408e8206cbebe360498ffed","sha256":"c31bef488aa8dee63ffe8601ea74d02285c0e9f189ff5540a94637b3a0fe99d9","sha512":"925ed13622d0b785921820f1b52ab0ad19ad44b8467ec1e15dfb03c9327dbd16ef037e1f11f9fdf80cbc4d9104c08a62c02b4651786efad4547aa5dc11dfe89b","ssdeep":"768:0xOyftQBCLo1sw/cexpme6piT5nQk8v2RbgFoF4OnImsSfWdLyWQL9ZsBpi0vRxv:UtQBQo1sAIeaE5Qk8uV4oF4OvpU5xMMf","tlshash":"d6a383c8f6e6f060439364b8803f110bf23e795e680e84a4f266d9d66cbc59d9127f79","size":106254,"data":"","first_seen":"2025-09-05T15:12:16.336085Z","last_seen":"2025-11-07T14:36:24.450735Z","times_seen":219,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/tPdbiW_V.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"af7805d42f0e94d87c24a603905aa544","sha1":"7b8e20de9b8033988fd4fb49ae5214be2a1b317e","sha256":"67962a43b72e5541bff19a54203273e73fa6a40aef2c34b20da51c95817d336f","sha512":"4f5b71fae1dbed1ca64d3290836d4ee5f28885ca526c71eaccbad91c58ee45a25d2a2e847846f68d8e02509d5c833f84c2e7a9928991b0418953cbe3dc954732","ssdeep":"","tlshash":"07c01285d8202077cc607828a1d20f42027e3644e115d17c77fc2482f470565a4aec65","size":192,"data":"","first_seen":"2024-05-07T05:56:57Z","last_seen":"2026-01-21T08:18:56.877435Z","times_seen":55,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DXFcmPY7.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"f35775ff648ec6716f2a297601310e96","sha1":"7305e85cbb919d8b85f3a5930e3f296b5e6fa785","sha256":"4511ce05d79359267133ee9e7e89fe59be13436a70679dacdf294e07de1bdc6d","sha512":"c81450c578ff1a8ef035a1d56429dd637b3533bde838720faf99a48ee0d1805b8f24567ecb757ca921606067907d517d04226b17383e91d3a37c4fce563a34f5","ssdeep":"192:XqsxSEFu6ZufGq++k5q2IkZQ+tOWwYpsTctY0ipgNE7oVKRpnKFEN:XhZ8fK+kQ2IkDLwYpfYZplOKRpnv","tlshash":"c212e9e473ac72aa59630dd12475481de434e6243b26f4d1f2ba38bab497c44b273f2d","size":9180,"data":"","first_seen":"2025-10-04T05:11:03.241006Z","last_seen":"2025-10-07T18:16:30.134044Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DxTym_EP.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"a86bd43371591230ada5d1456dab8aa0","sha1":"b63e835649ce8bec3af500a596a7a1f58272afb2","sha256":"23ec8c94b2d36cce2ca68ad1e07e75f81b886d3d0077acde44ee2f5981e3ca10","sha512":"c2f22c55f07b8c50d90c20493fc7dc2b4ed68615b8adca2c23cbb0c8439285544b86a623e919ed65f23f8dd6202d553dab85551ce8953e3e9c963b24ff059899","ssdeep":"96:oeyq53hKMoKMj1W3FdeF31f5HnPx1oRstVCBR4Ir8Dtgjiby+qUECPRv5:o83BY1W3eFFvmQVCkIgJbtD","tlshash":"f5b1a7e4b1d9e09bb7b64fd1c032225260076ba57434f0d0f27aad73215be54a562b3f","size":5164,"data":"","first_seen":"2025-10-04T05:11:03.300471Z","last_seen":"2025-10-07T18:16:30.054069Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/fp2.min.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"02087a3f4f46b15bc198570d800bff41","sha1":"e59f5e3521d8c60e5772de1f65c90e5b87d9eb9e","sha256":"e753042decd90a96d0636a7df16df556860af92ca09ac37f0f6ab1d574acd1f1","sha512":"2c733c348e26c0b400befd5ccac6734eb06a0ca0c8c638f8d3a66afd75ea5860c6cfd3a913ba6dd6824bd9c629c2f28d14204efa625b10fa8fd9b366ba82c968","ssdeep":"768:J2N6EbuZaWRhGT8e20R5J++t6cOrVrzib:oxuZaWRhGoF0R5UVra","tlshash":"e6f21b96b2e8373c8143b063394bec15fb799495e784808a5e2d4180f8758e9e77bdf8","size":34877,"data":"","first_seen":"2023-07-23T18:22:17Z","last_seen":"2026-06-26T20:23:29.90284Z","times_seen":1217,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DUaaTVgP.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"b7ffa89853e25cdd374f1b1b43dd9270","sha1":"0b818c53ddb47cfdfb2744f8885a52580139ce3d","sha256":"606f1e6bf95874e266928a81253820b7d84c7b825e49df2383961e32897c6b6f","sha512":"31973f15fc25c05ac174b2eeadf1f7a2a110fd9ef2df8c4a2dca421e8e3d51da6a7eaf1f8192f0f0e97e899d82d2eb17e80a74fe3a323f80c7b7ea632e3b1370","ssdeep":"","tlshash":"703144c9f29ce4b7d0e7d7e88472802076d875fb3fe8dbd5824099715623096764ead0","size":1671,"data":"","first_seen":"2025-10-04T05:11:03.445851Z","last_seen":"2025-10-07T18:16:30.060895Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DlAUqK2U.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"25e3a5dcaf00fb2b1ba0c8ecea6d2560","sha1":"7850b3fd4aeb69387bdb5a60025d15c41351d5eb","sha256":"cb85b0f263dbe24e857338301c0627076592e9f1f1a5662929f86d2c126444aa","sha512":"2e5cc9b53d5641147f68c73e5db0442d93fb6a64da45cfc051da5550a2fad07e912e651bd730e54325ef74eb706be0c5df612355c1dca144ab6e9cc8c4ecc73b","ssdeep":"","tlshash":"1fb012c81cc3e078939818d47738c15844380448310742b0808c0943e2c20809797c1d","size":91,"data":"","first_seen":"2023-03-08T16:39:49Z","last_seen":"2026-08-17T14:42:22.540243Z","times_seen":25631,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CFzQcB0L.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"e03518ae3241e6dd395a063ba226f056","sha1":"ce8d73c397d5dc7ee93d3f441458d108201216c3","sha256":"5d716e4a24b41b70d9761f4ae2cc82b40a9e511e6cc6b8928bf37c1d61fc6ef6","sha512":"3de9e95ab046329789ed32f1404e4461988c1ce6bc41d1740d7c73cf1a87f4b802920111f593f14038981c80deb5d91190e6de0ba5f867f5b2a7d6b1062d6c60","ssdeep":"","tlshash":"3b11344e90351e9dd06ccfba806af38330609dbb2713e0597919d1a43eda4034d28f32","size":926,"data":"","first_seen":"2025-10-04T05:11:03.43181Z","last_seen":"2025-10-07T18:16:30.089715Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DRLB4-_R.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"edbd750ef08a3e40bd3f93ef00424804","sha1":"2910560cc99b8e5fcf85488d82a39cdc3d45c09c","sha256":"19c614190f4a1ff133dd089486879e169ff387fc1dcddaf2177eb99e03b86f4f","sha512":"78fb844b4a23955443ad1a90c1ece096cf92e30a1b05a64a80d332774ad2063a4491e18a2a2afc1788c7762670f8638d1833868ff05f3775eeedec6acf4fd290","ssdeep":"","tlshash":"d5f0508b1caa18941de65f779027b1d2337a516e01518085feb1e6c4a10759ef32f430","size":513,"data":"","first_seen":"2025-10-04T05:11:03.352335Z","last_seen":"2025-10-07T18:16:30.062849Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Br1FBsO3.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"767f58379d7921f95c8dc6c600a3df03","sha1":"13505dd414f4a7979cc3098535dd88e1e1ce193e","sha256":"fa877f9e586ac8365282757cb02e92b352649b7ee3f6cb33eb0026bb4f1c95e9","sha512":"57b4279a8e6d24ffa4bd77e6812666ea155eca8cb4fc3c1de0b42259393b937babb44298e1a70c2910ef36fbfc356c2e4aa32b36583304980a9e2f2fb98062f9","ssdeep":"","tlshash":"9611ce2bfa4a1b6263331c7646a931e6cf650b8b2c7994c43c54df261237c83e5a6f54","size":1029,"data":"","first_seen":"2025-10-04T05:11:03.632172Z","last_seen":"2025-10-07T18:16:30.14286Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Bo795GQm.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"a223b34c3cdb6967c1095dc0a28a2b7c","sha1":"1959829472750c79c3b7cd33480ea6f383d6b9db","sha256":"5c8ee49059757cb7f107a35fcbff4e413488a00cd8068c8aad9e54cf53c91db6","sha512":"567feb951deb89ec211671f30b2ab5ca4c2b7c53faadb151ca813d5b6508a293037b5e4d794e0d49dc896fbe38b53cccca5caaed64f770b6b33e9e253f075956","ssdeep":"","tlshash":"2ed02bceeb7066b4bb10455d509bc752c728f90012a86ac1987b6ea13f109c6c346fe2","size":285,"data":"","first_seen":"2025-10-04T05:11:03.526688Z","last_seen":"2025-10-07T18:16:30.08633Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/pwa-load-event.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"f463b05f25296c1e185cc82087291f6e","sha1":"d15dfa009eaeeaaf36af83b20ace25714adbc583","sha256":"3f5bcf295bac81715b4413d640843ee19600f6a17c96503038c6a4193c331865","sha512":"5ecd0baa189383e24afadcbe391266fac63cdcdcb7da68ab1371168fae81f05f0140b4dcd86bc4cc59f4ebb3f5949e94b302f05de00942886fe3060436ae03bc","ssdeep":"","tlshash":"64e02b7483fc55b808e182b75f47bb15116721a77068d990c1871906f8d148780a2fd2","size":375,"data":"","first_seen":"2024-08-19T15:07:41.99372Z","last_seen":"2026-04-15T02:03:05.836861Z","times_seen":94,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/b-vBzq2i.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"36c0c6b8ef144d7bf7caa7079c3a416a","sha1":"8dd20af034fdbf41e59ffbc3aa163434f7ee366a","sha256":"3680ac7d48ce5a8a0c9fde6d13412fb8edae11c7de9830872df097f8aedc5abf","sha512":"927260065160a49bff0120fc290821cc672903ea0d9135823628640c37dbd0e28581b0266cf1d189d1eb33fe85ae593c49035d3bb673b31857c5a49d2903913f","ssdeep":"","tlshash":"856141fc1635a57226eb17bb43620ca242764845f049b27010da8f0d592dc984bf3ffa","size":3347,"data":"","first_seen":"2025-10-04T05:11:03.465869Z","last_seen":"2025-10-07T18:16:30.055353Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ls-cdn.amplitude/analytics-browser-2.6.2-beta.0-min.js.gz","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"a81d9804ed47201de5314a7110e680be","sha1":"df58e208599843e46894e9c2bbfdf2feb2a985a5","sha256":"59dd69f4230f7535182747c17235fe4526d34826a142498485779bfdb5d617f1","sha512":"2c15805effa726a40e1b3156d003df4b5f602ab4c1b09b8897ff759d143c0a33a5eb7cc90887b850b1f209ccb05b7be263935ad805ad86383f88947d777fdb42","ssdeep":"768:p6wmsZPARRFO/J6zZsideR53I+dte7I4GWyihZurBJ8:/msY4/JceR54+zeU4GWyaZudq","tlshash":"f35372c9f6cbf0250393a5b8907f140ab33e7e9d242d4428f626d9d53c6d6499233bb9","size":66596,"data":"","first_seen":"2025-03-26T18:10:08.318249Z","last_seen":"2026-06-26T20:23:29.909592Z","times_seen":142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-VRDLWS0SHC\u0026cx=c\u0026gtm=4e5a32","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.72","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ae80a05830c5e15ed5b7bed1b4c297e5","sha1":"565a22ceb998989e3c6f013d689d95cd7ab55ccd","sha256":"c14f3f71304d803cc4514a5c303246b4e5befe18e5dd05f56bc5aeee50af0a2a","sha512":"d2a82ab1c448a1aee1eee1ff77dd47485d29b128ff061d213c1beef6156f97359ef43b8c0a7ac98753b84c45774b9170e33da2b62d388450504edaf709c3c93b","ssdeep":"6144:Amxhrv4FZtfctlQR/cBWAc7zfdkpbbnWOUqgwLMP:Rb4FZtfLRPK0","tlshash":"4c8418ce73d670225396b478503f018ba57b28a2f44cc899f189dde52e74a9a4237f7c","size":375596,"data":"","first_seen":"2025-10-07T05:14:26.641496Z","last_seen":"2025-10-07T05:14:26.641496Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BgUJLoS-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"3d2c02d74f4c0768d16385c23713a8c0","sha1":"1e2f8b6a1650552df13bd17f73f349846209ee3c","sha256":"8512dcb0a79df73db990833caf165aab1438ff109b77ddd32e991b8b0a69adff","sha512":"7ac5308be49ee81fff510e3d24e13ac74a8a6d69821206891d8e8a82542370041a96fb5012228d6288aa1c3892b3b4d6ee558d608c84817a858b19611b3b74ef","ssdeep":"","tlshash":"4f51421e7eda54310b2a2830e09714a3a009dad11c1dc721b9204d9d79b1d96cdb3fef","size":2783,"data":"","first_seen":"2025-10-04T05:11:03.439288Z","last_seen":"2025-10-07T18:16:30.141403Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CkMSVCQx.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"79068909446126a70dccef2e4c2a06cf","sha1":"3f1f59ca79626ad920c3f2ce34109d2d06ca1b7f","sha256":"8214d22013513fb9a76d56a5723c9ecbaf725ebb9beff448232c77e30a459faf","sha512":"437b07be547ebde1a4dac1fdcfbdc3521519d219b964b3e1cb959bbf76c98f5165fc8af5ed54a44cb436d8b827326c03020820e0dd888540088fc28351669c12","ssdeep":"6144:EW2i6XYOhfa7HN9OCjhpr9SPXiBfmECS4Teq2YvnqX1SnI7mbvnQGcRjsXKAiH2i:ZXkhS7DO+hprP9mxS4VTqlSnKG6wXKF","tlshash":"6ea45ad97196b02213f619e4807b0106f3392a54384ec4e8f16d9eeb3d7690a92b7f7d","size":483068,"data":"","first_seen":"2025-10-04T05:11:03.286196Z","last_seen":"2025-10-07T18:16:30.070847Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"5f40956282de48d54afe03619e098768","sha1":"43d1a489ad2195c604bab8d857289e44b8068b4d","sha256":"4d19985445df15622f63a916964ecee88196fe654678c0b02540e5c85aa88129","sha512":"8c4769d2a900e98d01c00316f4d9bd2be5be1f7039d3a3ce6f0a7fdc0ae437ac358e8ade5e4dc240b9a2677745235110b922e97f531fa2d0de9c5be205c6d8a0","ssdeep":"","tlshash":"f951d979e0286a3fa016198c74053340584c9f3f60ee3d58d4c6dba4bc1b35f2ab17ad","size":2629,"data":"","first_seen":"2025-10-04T05:11:03.692691Z","last_seen":"2025-10-07T18:16:30.147802Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BbqPNdSU.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"d41b27ae63a30ec5d67cd47eabe3049e","sha1":"d1c10551d8dc1c36a70afbd414a0536cf64bc8b5","sha256":"d15f6a0302235ea1ec65d60e9c153f9edaf3344ac40599380885512fe83dea5c","sha512":"44f9246dede1ff1a1665f88dd0042c43ecefd28cf64dc01d4b34d60c88b6fa95255cf0185582c3c23a88f8edd54fb01d8e47576c7aca101ebc167b8de3f2b05f","ssdeep":"192:tXiFojMIZjkItgj6pnaJe/HA9iReMDjHMtpgCtAoRXSAd55rD1W55Jr0UWip8W4a:xiCMIZjy0LhYRHMAhPMN07i6jC","tlshash":"1c0240de520a64b00bd706fa81e846d0d6b00844f04d997c64f8dddf477ec8917a6bbe","size":8647,"data":"","first_seen":"2025-10-04T05:11:03.58126Z","last_seen":"2025-10-07T18:16:30.056453Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C7dbclZ-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"95814635ccf28c50f7025b84ae665292","sha1":"8e7e49c92a940b1a223f5edffc0141d2eae81daf","sha256":"9a5cd10c23cdcfccc8d47bb126a9dad6ea543a55ac206a7126e60d4d69842962","sha512":"63952aaedcd202a8fe7a84815bbd88419337298120c012e558f936441376d532b8dd5c8cf97defe4c1afd5673bc89c62df73e4443c57f573c8e74a95d703070e","ssdeep":"","tlshash":"9021357d4aec2dcc491cbc842ad89d6c7504d249a191cc9638a6fee7f487d5aec48471","size":1111,"data":"","first_seen":"2025-10-04T05:11:03.592519Z","last_seen":"2025-10-07T18:16:30.123656Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DVB3Cdql.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"20eed75093de2fc9d2444246aefbafec","sha1":"4f36aff0a4fe6f29e8db087ce85d2caa85dc3f4f","sha256":"fd6447eb787622249c366ac85f7ac12f55a700865902fdf1a5b6dd6997096769","sha512":"a11c3328cbef91f50466b6d9c8b4b01d21e125ce99a87a5ee73e296f08fd6f81f72a1bb79f7ea9800f09266f2b04d48ddf49905e6d60dc5d7cf899cf8417a0e5","ssdeep":"768:bXU8MMca080Hjkh5UyvucDYxhROs9SewPpUzSsLP20+6a7kHGQPLFODM:OI088a5bvuc0xys9SeSpU1Lu0+67mQhN","tlshash":"7ee2c6cc7641b018a3a711b6e1ef580fb37a2984980e8554a0aef5e43d7c4bd43abddd","size":33499,"data":"","first_seen":"2025-10-04T05:11:03.415244Z","last_seen":"2025-10-07T18:16:30.105627Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/4v6vyIur.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"10c92c717f8762cb181545e7d2c6b331","sha1":"712d5130ad1deb5bae8e8e479a21d4908274dd34","sha256":"dfc421c8fbb78ff109f24399be0a334cbf47b3b407cf2bc5c31f50e2da4cd9a0","sha512":"34893e23627e8ef59a86fd8bec5618574feca8590438c4edd0f6f59efb2cfd25ed0b3bc334c2d4afe53e9e96f45ca65bb651f5ac475760cbcb269ac3a6c6eb23","ssdeep":"1536:QsrUHXu9+2FYnFjqN1q46HAXJF707AMvrHCRAxpdh5CVaJwBNI5tdJked5qK:QxHXuw2FYW2T5Sa1RdD","tlshash":"bed35f4b4e0c0e7a056217b12fada7b362acc07471dbc3e557bf82182375475aea279c","size":136604,"data":"","first_seen":"2025-10-04T05:11:03.528287Z","last_seen":"2025-10-07T18:16:30.112258Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer/v1/analytics-js/snippet/233e4c5f9379d04ec864/analytics.min.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"009ba376452e3bdba0f98538c0575d44","sha1":"7fc6cb65590b122da408e8206cbebe360498ffed","sha256":"c31bef488aa8dee63ffe8601ea74d02285c0e9f189ff5540a94637b3a0fe99d9","sha512":"925ed13622d0b785921820f1b52ab0ad19ad44b8467ec1e15dfb03c9327dbd16ef037e1f11f9fdf80cbc4d9104c08a62c02b4651786efad4547aa5dc11dfe89b","ssdeep":"768:0xOyftQBCLo1sw/cexpme6piT5nQk8v2RbgFoF4OnImsSfWdLyWQL9ZsBpi0vRxv:UtQBQo1sAIeaE5Qk8uV4oF4OvpU5xMMf","tlshash":"d6a383c8f6e6f060439364b8803f110bf23e795e680e84a4f266d9d66cbc59d9127f79","size":106254,"data":"","first_seen":"2025-09-05T15:12:16.336085Z","last_seen":"2025-11-07T14:36:24.450735Z","times_seen":219,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Bo795GQm.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"a223b34c3cdb6967c1095dc0a28a2b7c","sha1":"1959829472750c79c3b7cd33480ea6f383d6b9db","sha256":"5c8ee49059757cb7f107a35fcbff4e413488a00cd8068c8aad9e54cf53c91db6","sha512":"567feb951deb89ec211671f30b2ab5ca4c2b7c53faadb151ca813d5b6508a293037b5e4d794e0d49dc896fbe38b53cccca5caaed64f770b6b33e9e253f075956","ssdeep":"","tlshash":"2ed02bceeb7066b4bb10455d509bc752c728f90012a86ac1987b6ea13f109c6c346fe2","size":285,"data":"","first_seen":"2025-10-04T05:11:03.526688Z","last_seen":"2025-10-07T18:16:30.08633Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ls-cdn.amplitude/plugin-session-replay-browser-1.4.0-min.js.gz","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c19b1b5d91c8d683b1310562d9c4a225","sha1":"4d45dcac5c6a88e10052f4e356b2170c20413441","sha256":"bb5779145f1ebdcdee053876a4ed060174dda4656978972304c79ddd5f36dac4","sha512":"3a4e8d2e8f5d9a3b45c08ce99374c149a5b67d04d016edfe6259dfbbba948a049301c0cfa5f9bf334cb93b9b4a3558cffa725c166a943c90834c8d2237a1a21c","ssdeep":"1536:Ask/3qTBpVX0Ib6vhb2pJkuppl5METErM2jnpkDtoT1JaM18PIQunrr9gltn2BE/:IqBfX046vhb2pKMQt1Jawi697w","tlshash":"4ec329deb397b033539355a980bb0101b73a6a19300d4464f62ad9ea3c7d847a277fbd","size":126923,"data":"","first_seen":"2025-08-09T06:39:58.991299Z","last_seen":"2026-03-24T13:49:06.781634Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CFU304S8.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"65b0cca89e40818f39fdd7753db6d142","sha1":"24e169a25a2e5e795d2ba4918ad600ab939bc23a","sha256":"261a0d9b3884cb4797de2dd31290199dbcec4f295a6ca9ee2c3b48ab9d9651ce","sha512":"e4c57b7230da955929c01aa05a22c6039a4ab395d6480587e21169106ce56e84aa99238c37d03c5944a72a6c799d55cc072ee59b5e498caf41fd1f6e021b43be","ssdeep":"","tlshash":"53b092d6728a3ce12602b810a15b80b4a131e6240b8a47208026f08739724a48a52e38","size":120,"data":"","first_seen":"2024-12-07T17:14:43.577967Z","last_seen":"2026-08-04T09:28:00.148891Z","times_seen":102,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DUaaTVgP.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"b7ffa89853e25cdd374f1b1b43dd9270","sha1":"0b818c53ddb47cfdfb2744f8885a52580139ce3d","sha256":"606f1e6bf95874e266928a81253820b7d84c7b825e49df2383961e32897c6b6f","sha512":"31973f15fc25c05ac174b2eeadf1f7a2a110fd9ef2df8c4a2dca421e8e3d51da6a7eaf1f8192f0f0e97e899d82d2eb17e80a74fe3a323f80c7b7ea632e3b1370","ssdeep":"","tlshash":"703144c9f29ce4b7d0e7d7e88472802076d875fb3fe8dbd5824099715623096764ead0","size":1671,"data":"","first_seen":"2025-10-04T05:11:03.445851Z","last_seen":"2025-10-07T18:16:30.060895Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BqzaD3Pl.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"48659d4240295b9e64caab349266ed60","sha1":"72d8336e72ca76db1563fac1c496ded6ff65ae3c","sha256":"127ea5b1a4a77e85a4a100e7f9301b32e1e607a2c9b3b9f714def75e098b0ab1","sha512":"4ad1491e8175e0c642a3032062dd6e2ebb251ba4c1b94e4192e4fa50688cfbf6b748d45c0433bf36af924f90c65f4bb9e35267929b16482411800a5346042745","ssdeep":"","tlshash":"e8f0c92eb1dab43543ccd8c441380c006861ad602c0e218ed19b9f13b1d07a3708bd30","size":510,"data":"","first_seen":"2025-09-04T16:11:26.386239Z","last_seen":"2026-04-12T00:18:50.830483Z","times_seen":46,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes-format.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6bc38f77922eaa6f1b23716034b4a2e","sha1":"db781b1e30c4f2a1d63d47054f0903c463cf01ab","sha256":"9ca00bddae85e30d59672da0089ea5e132df97d75a92f42114fe1befbaeaf32d","sha512":"0ad7c00c1564d77f8463dfc81003c0d6cd6ada4e3d01094331f72847f17718e4a6b2c7a2a0bcbd96a1107bc6cb9bcb1721e7b2968ae4544595ab98d39bb30c82","ssdeep":"","tlshash":"163177407debb4c287e8e1d50435a044f67b7a0ab1558ef3aa5aa404ffedf3006326e4","size":1494,"data":"","first_seen":"2023-03-07T18:27:54Z","last_seen":"2026-08-07T16:57:51.090464Z","times_seen":717,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"243dcbbab1864ae304323accde3f63e0","sha1":"7ac807de29469c5e810042601c8a11bf3601b893","sha256":"43ebc8eaf80b1efe8dd36390371da196ac1ee2ce30e3210b583a7adf20335fda","sha512":"2d9905ef903fe79fb3c24a2c552599dfaab246622edd7dc9348fd4d593e0351166cbbf59d306849c6601839c6198884f1fc600ae9e0728ea7f26cc363c58343a","ssdeep":"","tlshash":"d8a011802022a8030aa8800c022bbb003a38abb0a280022082308208300a023280a388","size":77,"data":"","first_seen":"2025-10-04T05:11:03.69028Z","last_seen":"2026-02-04T12:10:15.553292Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/google/recaptcha/api.js?render=explicit","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3af0043d752e1f849a37e90034b17970","sha1":"28b5a85d9651367aebf94b9db480376038ab03bb","sha256":"bb684f90e7c385ad69cd81f413a0c13a5a20ad2687475903b53d6d2e7833dbd5","sha512":"63c98400e269538ad3cfff737bd0ef881531941a7810a82606fb138f30c0bd93e86aa59411911f082f3a2be195653ddec6e893402968a52f1c1b2cd97dc4dbc8","ssdeep":"","tlshash":"1c111f731a18e0394b3219e1a2ffcb71e492701cf15845e8a556dad42e7adcbcf05488","size":1060,"data":"","first_seen":"2025-10-02T14:31:26.452384Z","last_seen":"2025-10-09T10:23:07.432637Z","times_seen":51,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtm.js?id=GTM-KN757LMM","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.72","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"36f52237f6b35b30a53c3b26ffba0ff6","sha1":"270d1cfc6391a45e8c856d6887cb47069017b781","sha256":"a714b9dacbd4f8ee9be8a2b6f68b1df3d7f0b82a24c9b0f413ce4f16e3e02b3b","sha512":"1560e165aef1ffa16235c8f34780f78cc0ec5957621537a3b21d324d1853e64f1dcdfb7540272b1a1c7014052bba4e132cd9101f0132169f43d7db0cddf23cb1","ssdeep":"6144:ldx1rzFQtfctlmzMR/JUBWAc7zfdIv4teNVP:l5PFQtfER57c","tlshash":"d38428cdb3d6746643a3a478403f014ba17b68a2f84cc895f185dee52e74a9a4237f7c","size":386300,"data":"","first_seen":"2025-10-07T05:14:26.60381Z","last_seen":"2025-10-07T05:14:26.60381Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes.min.js?v=1","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"cd93b7f0987a614bc17698503bcb6af9","sha1":"68a66448326499ff34c75bf31e2769b278584e0c","sha256":"8d4fae1a37a5b5338c889d0897b50024194b4d3ae94940e7e42c1c1423a1183e","sha512":"e3b87dfe10c0e3f3d801a85ae9c654a74eac22c2a93a757568a0d2b13755c36aeb5f9337e94a21db4ef2d1f0f1cfb98fccbbb0151d5cdf8d967730df96bfde98","ssdeep":"192:9BIGDmDm90mP9z8Ui015lN1I5rI2Tru6hMJFmHV+mdpwIfyAaYfKnNVYkUUFJZm3:9yiB0ez8UiIX1SrTegsEHJuI+y8Z7AX","tlshash":"625297c936edb94263963028587f6017b86b28b6945c4824f29cd4ddff9899dc03ae3c","size":13722,"data":"","first_seen":"2024-11-30T18:08:34.076577Z","last_seen":"2026-06-26T20:23:29.818692Z","times_seen":1206,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/4rtQVv8W.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"fee98e2133557b5174d80c41eb5ebc14","sha1":"bed9b980ec37764ad8100634005e005bc18a0798","sha256":"a69a8cdcdd23f4eccbff43ca93c4524fa6285410da77b6d14b7177e900a25ba1","sha512":"410b0aae21ddb19ae205427032d36117ac8053b36f1bc355b00b316ad1db1710e1b556d9b4c1a66c0f7f8f60031588d62ce11338615f75ac0872fb28c1d52165","ssdeep":"","tlshash":"77d02b5d503290741176055908db0d06d147a4b9332552246562aa752698592464ae06","size":259,"data":"","first_seen":"2025-10-04T05:11:03.22978Z","last_seen":"2025-10-07T18:16:30.111211Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/b-vBzq2i.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"36c0c6b8ef144d7bf7caa7079c3a416a","sha1":"8dd20af034fdbf41e59ffbc3aa163434f7ee366a","sha256":"3680ac7d48ce5a8a0c9fde6d13412fb8edae11c7de9830872df097f8aedc5abf","sha512":"927260065160a49bff0120fc290821cc672903ea0d9135823628640c37dbd0e28581b0266cf1d189d1eb33fe85ae593c49035d3bb673b31857c5a49d2903913f","ssdeep":"","tlshash":"856141fc1635a57226eb17bb43620ca242764845f049b27010da8f0d592dc984bf3ffa","size":3347,"data":"","first_seen":"2025-10-04T05:11:03.465869Z","last_seen":"2025-10-07T18:16:30.055353Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/w_DUq-AR.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"4c6bce4ff408842b72be9810227b096a","sha1":"905b7ba6378ad365efc082783bc72ba90e804a34","sha256":"e8f8fa31e74b47742d52f5f9aebbd3220463ea110c472a0bf6d1bc44e4ea2d7a","sha512":"b2f00a387d36eb615467a74c0679c2fedac31af75325f6add5028027e538b0b419612738c6839d82cdc92a97c478d3a7da6657ccfa994d5a43fc7e8e67259bac","ssdeep":"1536:XK6l28I8DZzkXhvPS5uLEiMAa73hBlxvHB+CIdzkVXiA6w+EV93mBE09:66nCvPS5uZS8a9Q","tlshash":"c7832989f224b57782f75aca8376c20172a54984b809d4e4b0ed4d7b496e95c03afffc","size":86097,"data":"","first_seen":"2025-10-04T05:11:03.612073Z","last_seen":"2025-10-07T18:16:30.104994Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/4rtQVv8W.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"fee98e2133557b5174d80c41eb5ebc14","sha1":"bed9b980ec37764ad8100634005e005bc18a0798","sha256":"a69a8cdcdd23f4eccbff43ca93c4524fa6285410da77b6d14b7177e900a25ba1","sha512":"410b0aae21ddb19ae205427032d36117ac8053b36f1bc355b00b316ad1db1710e1b556d9b4c1a66c0f7f8f60031588d62ce11338615f75ac0872fb28c1d52165","ssdeep":"","tlshash":"77d02b5d503290741176055908db0d06d147a4b9332552246562aa752698592464ae06","size":259,"data":"","first_seen":"2025-10-04T05:11:03.22978Z","last_seen":"2025-10-07T18:16:30.111211Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C7dbclZ-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"95814635ccf28c50f7025b84ae665292","sha1":"8e7e49c92a940b1a223f5edffc0141d2eae81daf","sha256":"9a5cd10c23cdcfccc8d47bb126a9dad6ea543a55ac206a7126e60d4d69842962","sha512":"63952aaedcd202a8fe7a84815bbd88419337298120c012e558f936441376d532b8dd5c8cf97defe4c1afd5673bc89c62df73e4443c57f573c8e74a95d703070e","ssdeep":"","tlshash":"9021357d4aec2dcc491cbc842ad89d6c7504d249a191cc9638a6fee7f487d5aec48471","size":1111,"data":"","first_seen":"2025-10-04T05:11:03.592519Z","last_seen":"2025-10-07T18:16:30.123656Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/w_DUq-AR.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"4c6bce4ff408842b72be9810227b096a","sha1":"905b7ba6378ad365efc082783bc72ba90e804a34","sha256":"e8f8fa31e74b47742d52f5f9aebbd3220463ea110c472a0bf6d1bc44e4ea2d7a","sha512":"b2f00a387d36eb615467a74c0679c2fedac31af75325f6add5028027e538b0b419612738c6839d82cdc92a97c478d3a7da6657ccfa994d5a43fc7e8e67259bac","ssdeep":"1536:XK6l28I8DZzkXhvPS5uLEiMAa73hBlxvHB+CIdzkVXiA6w+EV93mBE09:66nCvPS5uZS8a9Q","tlshash":"c7832989f224b57782f75aca8376c20172a54984b809d4e4b0ed4d7b496e95c03afffc","size":86097,"data":"","first_seen":"2025-10-04T05:11:03.612073Z","last_seen":"2025-10-07T18:16:30.104994Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/zVFskexI.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"5ea5cccdf7fe73c144e70d799815d49a","sha1":"81bb06b30d93384c5161e2b6f8071ae99233346c","sha256":"ff9b0b00de6e591e7358f950969ab47c64969182cc7735d0f953a7fe2d85a70f","sha512":"48ae4ccbf48d353d4436238f7163e488638ee29f4049ba15a4ca4258a89a4609afb9d9563b4cdc56d88e7cb1d6e45c1d915309015410d38f6f716a35ddb961d2","ssdeep":"96:/SI0Lgam5pFjwsmyzqVBRJzxv7A28/s1/HEwYx+3cCL:/8mjsyGRFThSu/j4U","tlshash":"0fa1858f1240762e7ded4b5543f4681883304886fc1c27edf4ae5d389b5a88f61bb674","size":4910,"data":"","first_seen":"2025-10-04T05:11:03.358433Z","last_seen":"2025-10-07T18:16:30.125287Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/jXgXeeQE.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"f84804da82d9c4cb7ddd9e71f0ca1f6b","sha1":"64c4e19b9eb6ea410c08dd63881ddd0cb318255d","sha256":"2c0d1951397683fbd5db45458698ddee96bc097d1c27017de3493bd092d4b841","sha512":"87c74f73697be0716dfc5d1a33ef2f121591b1c214a1e4e2ad5c778f0817a36c52fe0bbd776c8abbe36532eb8182a1be5d688e4a9103748744a2718d4b51e618","ssdeep":"6144:cCuayegAufVcvTgOg1msMr0Ouyfo8x326pl5OaPydoMbUCzxNeuGgSBm5uz:cCuayegAufVcvTgOg1msMr0Ouyfo8x3p","tlshash":"bf247e320e5d1cbd1111a166de1cab1a38de81fe3e9b93e107796e6e35f10309ea931d","size":217183,"data":"","first_seen":"2025-10-04T05:11:03.708279Z","last_seen":"2025-10-07T18:16:30.087249Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/q3LSfRvN.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"aabcaf406092d2abfaf2865f8d6c345d","sha1":"dff4a863c03268754af54820528972e654b1b835","sha256":"3f9400210e7096afbc7663147fe16f41f85982ac363d1c8506040c5b38572ca2","sha512":"f9af6f7a796692d9ac07af0d7f8e19762d1fb44cf80af21335aaca29f928c5008d33e2156c039095e45a8590d25edf2bdb42d2dec34d2314d057f02001b773a2","ssdeep":"192:PpazyEaxrcxshi0pM3bumtmRNwDA8T4uC3/bR5AmMbgj9ak9rLX:xazyEaZcxshi0+SPQDvk/F5rMS9aeP","tlshash":"30d11bccb4a67021b3774ae5d0b78107763829a134cbd4e1e01eded73e15a62a792d8d","size":6294,"data":"","first_seen":"2025-10-04T05:11:03.316834Z","last_seen":"2025-10-07T18:16:30.09229Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CIV1DmJm.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"3bcb3cb731faa08f8e975f22576abf93","sha1":"05344c9790022a0d796fe682cfba3af36a0347db","sha256":"ee27ce8fd95c8b0501fb72850528edd31a3d0195819a462635ca117c897cc60f","sha512":"73d6c16f46985d8259360bab931cb67e77640c8585a6ef8df1950979b4eae173ae318c351dbd07548a5d6d4b28d596f35c41db8840566f386f52f61fd70fce23","ssdeep":"","tlshash":"0c118cc070a4a431c3b849c801d5abb2b55d96843de782d4e45e1d33213f89cc579b19","size":874,"data":"","first_seen":"2025-10-04T05:11:03.497488Z","last_seen":"2025-10-07T18:16:30.088926Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"bc61a0f508bba04511ad70f64799dcf2","sha1":"fdd3d3bac1be197361cb44b98f6e175c82f514a7","sha256":"6b8a7725ac979c423a99a9d5ff8d0ea5101bcd191c8f4a1e5465e05d3149657a","sha512":"7ab74618063b8027e4db1d23348430c3a34f0144cae4f45d50bb9815763dae69bd88f8137cf2b7b469a4fb24f381c69dfed66f1e5e71dfdd0c22158ac1b9ff22","ssdeep":"","tlshash":"34516586f325982226db38bda33e1346663217e20d5098f2b2319f417c187cbc526b4d","size":2592,"data":"","first_seen":"2025-10-07T05:14:26.73887Z","last_seen":"2025-10-07T05:14:26.73887Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/ajs-destination.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecdb24cdd6b5a3a4a7ba31895f79ca4b","sha1":"3284a1f3ba7aa68b324499a64bf32c8101701663","sha256":"ef949bb08ab368c25ce835e54a53b3eb842de7e868ff81ff99520ed16394637d","sha512":"e76cf7a6f407f484c5537258129ee7d29b765a14204c0cd4e1ee9ca3d9542ac01c5c0b0c557e704d8c69a1a12b29312b99ec0fd25608af07b3c79ea5a83d0492","ssdeep":"192:d61F3JpeOVXIhCBnMfJlUEpFX8nmuONy+2Yn:doF9TMsEzZuF+2Yn","tlshash":"5f1212ccf6c7f0055267bab5817b451ab33ebd1a244a4894f42bcdd5287c619a12bf38","size":9226,"data":"","first_seen":"2025-06-01T15:05:10.790294Z","last_seen":"2025-12-16T16:58:04.809767Z","times_seen":521,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes-format.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6bc38f77922eaa6f1b23716034b4a2e","sha1":"db781b1e30c4f2a1d63d47054f0903c463cf01ab","sha256":"9ca00bddae85e30d59672da0089ea5e132df97d75a92f42114fe1befbaeaf32d","sha512":"0ad7c00c1564d77f8463dfc81003c0d6cd6ada4e3d01094331f72847f17718e4a6b2c7a2a0bcbd96a1107bc6cb9bcb1721e7b2968ae4544595ab98d39bb30c82","ssdeep":"","tlshash":"163177407debb4c287e8e1d50435a044f67b7a0ab1558ef3aa5aa404ffedf3006326e4","size":1494,"data":"","first_seen":"2023-03-07T18:27:54Z","last_seen":"2026-08-07T16:57:51.090464Z","times_seen":717,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/fp2.min.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"02087a3f4f46b15bc198570d800bff41","sha1":"e59f5e3521d8c60e5772de1f65c90e5b87d9eb9e","sha256":"e753042decd90a96d0636a7df16df556860af92ca09ac37f0f6ab1d574acd1f1","sha512":"2c733c348e26c0b400befd5ccac6734eb06a0ca0c8c638f8d3a66afd75ea5860c6cfd3a913ba6dd6824bd9c629c2f28d14204efa625b10fa8fd9b366ba82c968","ssdeep":"768:J2N6EbuZaWRhGT8e20R5J++t6cOrVrzib:oxuZaWRhGoF0R5UVra","tlshash":"e6f21b96b2e8373c8143b063394bec15fb799495e784808a5e2d4180f8758e9e77bdf8","size":34877,"data":"","first_seen":"2023-07-23T18:22:17Z","last_seen":"2026-06-26T20:23:29.90284Z","times_seen":1217,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DlAUqK2U.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"25e3a5dcaf00fb2b1ba0c8ecea6d2560","sha1":"7850b3fd4aeb69387bdb5a60025d15c41351d5eb","sha256":"cb85b0f263dbe24e857338301c0627076592e9f1f1a5662929f86d2c126444aa","sha512":"2e5cc9b53d5641147f68c73e5db0442d93fb6a64da45cfc051da5550a2fad07e912e651bd730e54325ef74eb706be0c5df612355c1dca144ab6e9cc8c4ecc73b","ssdeep":"","tlshash":"1fb012c81cc3e078939818d47738c15844380448310742b0808c0943e2c20809797c1d","size":91,"data":"","first_seen":"2023-03-08T16:39:49Z","last_seen":"2026-08-17T14:42:22.540243Z","times_seen":25631,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Dacnxtee.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"320ec157fca2c96c27d5b58c11f14b89","sha1":"e0e5dcfb335de172aab5aaab6508452391e5c3f1","sha256":"afd2b3f48c1cce3897968123d1242e363126ef7fcfa9cb926362b79efcc7d4c5","sha512":"83a0fdbfc245ffe78730b87d76e85b4111d45fca04b25835a6cd24961857e9f68ff3bc21519d21ca8561d0acc704396c2144ca92393e78030ea6048c559c3794","ssdeep":"","tlshash":"a3a0120a0450007d208608e4675b509955e0142613b55a8100004a0106154de650cc00","size":86,"data":"","first_seen":"2025-10-04T05:11:03.670272Z","last_seen":"2025-10-07T18:16:30.094419Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/646.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"a06332e35d49c4e796d67eec315abbd9","sha1":"8010aeb075ec27f0b4cd0baf86ddffe0212b5f19","sha256":"513febf3d4b0ff4c7783a60bc3b1afbf2173bf26f6529882ada531c98d6d00be","sha512":"8393fcbc4d41e11e68b55a6298d7d64ecb3a2eecd271aa7ddb375dcca4bfa44ba4331811c7bc06b9c6ff556e89a680b65e3421a096889082bf302900c7384399","ssdeep":"","tlshash":"e811ab0a30b97015d7b90c9141beb90b657730b125eeca7af764c85648e072d8a53a29","size":1000,"data":"","first_seen":"2025-09-29T14:02:20.943969Z","last_seen":"2025-10-07T05:14:26.74265Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CYqDhD_K.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"1bbfaa6ac14a0d4a4f6a2bdb50403740","sha1":"da1db6943edc34407d541bf0999bebae565a73bf","sha256":"75a2ab6b9337408f843fde1e6ecf53fab99814a48dc12f1744621095a45bc852","sha512":"585e1e94ae1be8697cb4217da30bc9a3c01726a9e4ff4664f8a888ea03fa639d8a97d603f95684fc8f37b006f0ca6b67619a74114c7924cfb1d8a1646781c6e2","ssdeep":"384:gbLmDw0GjHIVo6eR6o1Shl449OsLV5jbHQ6NhWWxZ9HqDXRoOkm4Zes:gPmDw0MHIVo64X1NdshJTQ63WUG4h","tlshash":"479295c832c7f5968793197681bf100bb23e6d85a40d8892d53ae0d87c7486c867bfed","size":19331,"data":"","first_seen":"2025-10-04T05:11:03.43668Z","last_seen":"2025-10-07T18:16:30.136146Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Dacnxtee.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"320ec157fca2c96c27d5b58c11f14b89","sha1":"e0e5dcfb335de172aab5aaab6508452391e5c3f1","sha256":"afd2b3f48c1cce3897968123d1242e363126ef7fcfa9cb926362b79efcc7d4c5","sha512":"83a0fdbfc245ffe78730b87d76e85b4111d45fca04b25835a6cd24961857e9f68ff3bc21519d21ca8561d0acc704396c2144ca92393e78030ea6048c559c3794","ssdeep":"","tlshash":"a3a0120a0450007d208608e4675b509955e0142613b55a8100004a0106154de650cc00","size":86,"data":"","first_seen":"2025-10-04T05:11:03.670272Z","last_seen":"2025-10-07T18:16:30.094419Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CkMSVCQx.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"79068909446126a70dccef2e4c2a06cf","sha1":"3f1f59ca79626ad920c3f2ce34109d2d06ca1b7f","sha256":"8214d22013513fb9a76d56a5723c9ecbaf725ebb9beff448232c77e30a459faf","sha512":"437b07be547ebde1a4dac1fdcfbdc3521519d219b964b3e1cb959bbf76c98f5165fc8af5ed54a44cb436d8b827326c03020820e0dd888540088fc28351669c12","ssdeep":"6144:EW2i6XYOhfa7HN9OCjhpr9SPXiBfmECS4Teq2YvnqX1SnI7mbvnQGcRjsXKAiH2i:ZXkhS7DO+hprP9mxS4VTqlSnKG6wXKF","tlshash":"6ea45ad97196b02213f619e4807b0106f3392a54384ec4e8f16d9eeb3d7690a92b7f7d","size":483068,"data":"","first_seen":"2025-10-04T05:11:03.286196Z","last_seen":"2025-10-07T18:16:30.070847Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BVJD_FzT.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"7238102902131e678624d38a52b93598","sha1":"0bbded74519658146adb846e34a258dc1d0dca03","sha256":"05cf9f3b464f937efb279653d4a70ece477c25c3db903e720cfb062a06308146","sha512":"3cc8cefecce474edd6549b99baa958ada12a1a7f5b5b5f360c02a362bbc63cc7b1427b65ee0f211281de7e4f3fc0c238e7ba192aade89ce8554cb4c0aff4179d","ssdeep":"","tlshash":"1ef09e8e70a3d2b0b777c789c937c642a47c1e52380de5d1d04a5a45324b481e73d72e","size":512,"data":"","first_seen":"2025-10-04T05:11:03.419457Z","last_seen":"2025-10-07T18:16:30.061836Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Chd1ThOZ.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"317a2201ef3851dba19e8b41380c8518","sha1":"69f8afc7452ae5bbffe308672417d74ea784cee0","sha256":"64cbae9ec71c97c3ca661b3a42c7f0de57972f702378830b7911e5a148b1cb0b","sha512":"4d8e02b904019b8bc965749301e7a14aa67543e54a8b2a19862be134620f94b55e7a2481c50590bf05fc5b7f6ce8e54746b77e238fa7b3a83fbaf81345be42c0","ssdeep":"","tlshash":"372130aebb3aa7bc7c245a5f42306f30f0132096ffb8945cb8d22126e3425a155640b8","size":1151,"data":"","first_seen":"2024-06-08T05:57:25Z","last_seen":"2026-05-26T01:50:53.816934Z","times_seen":119,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3f52b82a3d7a4a96f6fb8aa00c0b4b70","sha1":"bd01ff0d513235c398da37f952a4053f21cb955f","sha256":"809b35e8d0b57b17aa98e9709ae1d193af6af844bff575c173e1b08e51c17cbf","sha512":"59a2f6df227ff847c5dabac3634010418006a2ed75fb7935978e2ff5b336de433e56c935e0003ae9bdfa990fa51626337fc1d681cb1ea8981c1d56d1b510d6f7","ssdeep":"","tlshash":"c521ce75f95bdc5409ce286e851f234be4740e59da21b19096f0eec128b8ab52582a1e","size":1222,"data":"","first_seen":"2025-10-07T05:14:26.743276Z","last_seen":"2025-10-07T05:14:26.743276Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/646.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c83e6df6ffa3af6337495fadc058adf3","sha1":"1bb413dd66d4e85907de4414bb98fd17be6ae482","sha256":"d128bb0eda8faaee8ff9b04a261ad0e835dfe1631768aa39c1a54952261d5787","sha512":"7ed7358de7f6d30a0c529a75c1fe9b1e6e79b34f8753538873c0c517dd28c52e423abeb772c0be518d344f2f513f3ff1c7b5b511aa99645b7596f4edb7771749","ssdeep":"768:i4V72U1y21F6WiEyKS3K/70fjjtRBlWBqnNyV18u8/zo8NyB5CJ:i41yGviEy+0vtnNyV18u8/zMO","tlshash":"bbc2f94a316a393d83d351e7bd7a3006633b7555b849c041b2ade8872f294cf6273f9a","size":26551,"data":"","first_seen":"2025-09-25T08:21:12.740421Z","last_seen":"2025-11-07T14:36:24.349236Z","times_seen":171,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/recaptcha/releases/Jv8jlA-BQE5JD6rA-h_iqNH2/recaptcha__en.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"79d46b9e2a42785f28f64082a61eabbf","sha1":"c1b66a198b40bcd1f6cce34704173f997ecd8608","sha256":"6159c42218db471f012088abd52e60fe39e5c1dcf2981ff7d80f38d8bd36a690","sha512":"820943d8b4d684933ce756b9d59c499147aae8336a811b042d8ee8bf035ecb20be12ff815d0ba4a8676c815b9e6bf2d687591d434bedfbbf07e56dae34f39c49","ssdeep":"12288:iF/YdSVcst0yzYy0Vqqog/cT6eKb54lptHAgR1BoOdy3aWKi:QQozYJog/Y6fV4lbpR1BRdyKK","tlshash":"b70529c870257a624332b5f6707b209da36e5966d45c095d70a6c4f03fb098db0baebf","size":820265,"data":"","first_seen":"2025-10-01T09:12:21.067891Z","last_seen":"2026-06-02T23:59:04.965062Z","times_seen":7915,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/zVFskexI.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"5ea5cccdf7fe73c144e70d799815d49a","sha1":"81bb06b30d93384c5161e2b6f8071ae99233346c","sha256":"ff9b0b00de6e591e7358f950969ab47c64969182cc7735d0f953a7fe2d85a70f","sha512":"48ae4ccbf48d353d4436238f7163e488638ee29f4049ba15a4ca4258a89a4609afb9d9563b4cdc56d88e7cb1d6e45c1d915309015410d38f6f716a35ddb961d2","ssdeep":"96:/SI0Lgam5pFjwsmyzqVBRJzxv7A28/s1/HEwYx+3cCL:/8mjsyGRFThSu/j4U","tlshash":"0fa1858f1240762e7ded4b5543f4681883304886fc1c27edf4ae5d389b5a88f61bb674","size":4910,"data":"","first_seen":"2025-10-04T05:11:03.358433Z","last_seen":"2025-10-07T18:16:30.125287Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/v/ui-resources.php?location=default\u0026mode=desktop\u0026lang=ru\u00269ae4a29f\u0026callback=getWebimUIResourcesCallback","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"11b438f338bd2b9e4671ecd18c16989c","sha1":"438b66fdfd873ff5f47c57bbaacd3ae1b0eeae27","sha256":"226f3be66a9d2f9f6a3bdad6e3e280a292f0d9bf7cce15fc382cb023bad866a3","sha512":"a6fba66b9240a4fec3298822e71776454c9ce66287af73b2839eeb18819b0af53f0076f22afbeba1c7477028333d5b07bcf5fa0d8a7fcf99c3fa355ae50bc800","ssdeep":"1536:QQHOcWqV61g4iy5VkMN2KQRgME234Cs57h7Fbsas1sUs+s1seT5Ggr6uN+Y3L5i4:cMCvyawQJ3gy5f9uZS44WkHD","tlshash":"dfd4270feed21469be2bee6361f70655713d34a29590079cb22f34de5f81ce29322b64","size":625730,"data":"","first_seen":"2025-10-04T05:11:03.45314Z","last_seen":"2025-10-09T10:23:07.246583Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/jXgXeeQE.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"f84804da82d9c4cb7ddd9e71f0ca1f6b","sha1":"64c4e19b9eb6ea410c08dd63881ddd0cb318255d","sha256":"2c0d1951397683fbd5db45458698ddee96bc097d1c27017de3493bd092d4b841","sha512":"87c74f73697be0716dfc5d1a33ef2f121591b1c214a1e4e2ad5c778f0817a36c52fe0bbd776c8abbe36532eb8182a1be5d688e4a9103748744a2718d4b51e618","ssdeep":"6144:cCuayegAufVcvTgOg1msMr0Ouyfo8x326pl5OaPydoMbUCzxNeuGgSBm5uz:cCuayegAufVcvTgOg1msMr0Ouyfo8x3p","tlshash":"bf247e320e5d1cbd1111a166de1cab1a38de81fe3e9b93e107796e6e35f10309ea931d","size":217183,"data":"","first_seen":"2025-10-04T05:11:03.708279Z","last_seen":"2025-10-07T18:16:30.087249Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes.min.js?v=1","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"cd93b7f0987a614bc17698503bcb6af9","sha1":"68a66448326499ff34c75bf31e2769b278584e0c","sha256":"8d4fae1a37a5b5338c889d0897b50024194b4d3ae94940e7e42c1c1423a1183e","sha512":"e3b87dfe10c0e3f3d801a85ae9c654a74eac22c2a93a757568a0d2b13755c36aeb5f9337e94a21db4ef2d1f0f1cfb98fccbbb0151d5cdf8d967730df96bfde98","ssdeep":"192:9BIGDmDm90mP9z8Ui015lN1I5rI2Tru6hMJFmHV+mdpwIfyAaYfKnNVYkUUFJZm3:9yiB0ez8UiIX1SrTegsEHJuI+y8Z7AX","tlshash":"625297c936edb94263963028587f6017b86b28b6945c4824f29cd4ddff9899dc03ae3c","size":13722,"data":"","first_seen":"2024-11-30T18:08:34.076577Z","last_seen":"2026-06-26T20:23:29.818692Z","times_seen":1206,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Cn9yliqE.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"19d5b85492f4d8505bb0d3df174e9e2e","sha1":"84b6548697aa030be332309225e873884d9f3dba","sha256":"79ce7f24d8f2fe12521d0d2ab3e1f77deec6ed8d84313c24f6b0e471532776a6","sha512":"0be04f2ec94f2b25a681d6dd3e61486c30aabe678dd82d01a56bd4a6d9fa45faae911209c277356941b283d09658258d66ebd35497c800c064db73ea06177e1c","ssdeep":"1536:kzGEyMiW9myjPH+UTrFuRSmicJ9HZBynmI0+iAFBynmI0+iA5zAGg1JxBynmI0+3:ktHPH+HFQttb40vzx8","tlshash":"6794b9e1f3a8a1ece017e7fcce26a471351a35fb3b91c5c44294ae749e221ac9d5dc81","size":446775,"data":"","first_seen":"2025-10-04T05:11:03.35039Z","last_seen":"2025-10-07T18:16:30.139568Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/inAppPlugin.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b3f92234d8907a103ec9dc2b05589f1","sha1":"2f2c0961bace40551cc39d1728715b94ec82db2e","sha256":"ae91906abf85a449f6ec41c31f1bc77b9bd3505bb7e55d61760b47c3fb11e3dd","sha512":"62174308a9634879afda50af1511adf6af4081ae78910db5c71cc0bb764cfb2c287c659d8653268b4b1eba7e6eb76b7b8096c1416a28b069f19e38019a7d38a2","ssdeep":"96:frYe+t6Sgb0qKEIwRGBMtIPmcKhgbUk6HEHvRrVxEC7NTjQCtGf8J4HJDFqK/+bD:Nd7KOwBMtgLgHE7T864KKqKk","tlshash":"3cb1ec9df793f82c05f39a7de5773423923a3b026099e411e057cec2596838d6123bb9","size":5580,"data":"","first_seen":"2025-09-25T08:21:12.736151Z","last_seen":"2025-12-15T01:19:11.275667Z","times_seen":356,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/js/button.js","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"587e13c24d17141fecff62e86a00ffc4","sha1":"b67c345ddb508d91f6aeb774a086db22cef92530","sha256":"b18d676e74a1991942986057293a33b529fe3b5bad23ba68c06667d67a1d225a","sha512":"8c61210e82be9f7e0581456056d8592a8c4f15cd5a361e5c37f57308d367406b80487b99a2c26a4530eb777f8ba43f7a5ea584d7bfdbaf710527871be5ececec","ssdeep":"24576:/o36wXnnOqCNTKi983ht1x2vRfXjXjryWsz9tQ:/o36wXnnOqCNTKe83ht1xYdTjryWshtQ","tlshash":"e2155c897644353a82dba2bf702b170976379552a444d46cf878e8d4bfb4d09823bfbc","size":899155,"data":"","first_seen":"2025-09-20T02:53:52.592022Z","last_seen":"2026-01-19T12:14:51.147852Z","times_seen":173,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/api/visitor/v1/configs/default?jsonp=true","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"638d060432ecb93780d761ece2001dbb","sha1":"497f80e2de439a0b5260eb9448cdfb7f5195829b","sha256":"8a2680517eb60dd29259f47c0cce83bbb653cd5330ac747b055836e4578974cb","sha512":"b05c7c566357807d136f35df56d69d9cdf8f1b4e3dace8ca3b4c3981cf8fb5bde098bc0076680aea6792dd8547ad14c6e5c6be969f660fa02b5a490b8c1a52ed","ssdeep":"96:mXzMOTx4alggVgY+/Syo6ygym/WYH9XOc4U+4s/cQtW6CVgpcf:k1OVY+KH6Lt/WYHccwUQw6CX","tlshash":"a1b141b1d126003b16c56a56ed396a8f277492d2e740ef3e8f1c0817f38dab562437e2","size":5566,"data":"","first_seen":"2025-10-04T18:13:14.581015Z","last_seen":"2025-10-09T10:23:07.378313Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/inAppPlugin.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b3f92234d8907a103ec9dc2b05589f1","sha1":"2f2c0961bace40551cc39d1728715b94ec82db2e","sha256":"ae91906abf85a449f6ec41c31f1bc77b9bd3505bb7e55d61760b47c3fb11e3dd","sha512":"62174308a9634879afda50af1511adf6af4081ae78910db5c71cc0bb764cfb2c287c659d8653268b4b1eba7e6eb76b7b8096c1416a28b069f19e38019a7d38a2","ssdeep":"96:frYe+t6Sgb0qKEIwRGBMtIPmcKhgbUk6HEHvRrVxEC7NTjQCtGf8J4HJDFqK/+bD:Nd7KOwBMtgLgHE7T864KKqKk","tlshash":"3cb1ec9df793f82c05f39a7de5773423923a3b026099e411e057cec2596838d6123bb9","size":5580,"data":"","first_seen":"2025-09-25T08:21:12.736151Z","last_seen":"2025-12-15T01:19:11.275667Z","times_seen":356,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DVB3Cdql.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"20eed75093de2fc9d2444246aefbafec","sha1":"4f36aff0a4fe6f29e8db087ce85d2caa85dc3f4f","sha256":"fd6447eb787622249c366ac85f7ac12f55a700865902fdf1a5b6dd6997096769","sha512":"a11c3328cbef91f50466b6d9c8b4b01d21e125ce99a87a5ee73e296f08fd6f81f72a1bb79f7ea9800f09266f2b04d48ddf49905e6d60dc5d7cf899cf8417a0e5","ssdeep":"768:bXU8MMca080Hjkh5UyvucDYxhROs9SewPpUzSsLP20+6a7kHGQPLFODM:OI088a5bvuc0xys9SeSpU1Lu0+67mQhN","tlshash":"7ee2c6cc7641b018a3a711b6e1ef580fb37a2984980e8554a0aef5e43d7c4bd43abddd","size":33499,"data":"","first_seen":"2025-10-04T05:11:03.415244Z","last_seen":"2025-10-07T18:16:30.105627Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CjIjlGq-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"8536f2f542c30c3b37aa68fa9d57f5cb","sha1":"4679e0eb2b374266ccf64bfc73ac98dad5143a1d","sha256":"84a0b743a7ef37e6cd2a2db660b4b5899c3fecce9d1f28502709614fc9d191fa","sha512":"126dd430ac683507fae1c2a1e11c5ff94a9015441798342ca77791fe29709b30c33f8b30ff1b10b1f08b51fac27d016fed4b2f8e724afb82dd8b57c2fbc7fbfd","ssdeep":"768:kC43aMGeQtDCPB/HyzE0qct7yxP2C7dSlSxkPut06BcftOashQWEhQEq/iiB8faZ:760xiywcV64IX","tlshash":"e303f8c8b2a0506583e2a1a390750203f33999153409855cbb2ceefbad7eeda7177f75","size":40164,"data":"","first_seen":"2025-08-19T01:32:32.322521Z","last_seen":"2026-04-26T08:04:42.226428Z","times_seen":67,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/google/recaptcha/api.js?render=explicit","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"0b536bf8341b9ddd054dc252fdb4221b","sha1":"32746a7636865259071992e8b96dc24242ae5e7e","sha256":"6659a13d4bfb02f73f9cb288e269dcece47de251bf82e4724078e0585fe64254","sha512":"4b2b662f14da571a0e32b9b4cb6077ed427fae68de7af6551304dc43ab191ab6af7dfdbda29ec5d3da158f4d32c38d0d39cb22091024ee2b538dba167728a6bd","ssdeep":"","tlshash":"ed1102731a14e0394b3209e1e2ffcb75e492701cf15845e8a515dac42e79dcbce05589","size":1019,"data":"","first_seen":"2025-10-02T05:22:43.534294Z","last_seen":"2025-10-07T18:16:30.149112Z","times_seen":255,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtm.js?id=GTM-KN757LMM","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.72","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"272c800c6f75db20fc0a7254caa5f760","sha1":"083a11577d53adc9b27cbf607549396c18bfc913","sha256":"d06cad0d7af90203afef6f8559896c1a44291a40624038b8bba675f092291436","sha512":"807ff4bfd8b40380f2c4361e6022f79ced17e7802ba08d805d1b0521db7b8fc0fd2c639ce9d045997a817f709a189ff5fc9615dc46676786df9386674286baad","ssdeep":"6144:lox1rzFQtfctlmzMR/JUBWAc7zfdIv4teNVP:lmPFQtfER57c","tlshash":"438428cdb3d6746643a3a478403f014ba17b68a2f84cc895f185dee52e74a9a4237f7c","size":386300,"data":"","first_seen":"2025-10-07T05:14:26.747382Z","last_seen":"2025-10-07T05:14:26.747382Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/ajs-destination.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ecdb24cdd6b5a3a4a7ba31895f79ca4b","sha1":"3284a1f3ba7aa68b324499a64bf32c8101701663","sha256":"ef949bb08ab368c25ce835e54a53b3eb842de7e868ff81ff99520ed16394637d","sha512":"e76cf7a6f407f484c5537258129ee7d29b765a14204c0cd4e1ee9ca3d9542ac01c5c0b0c557e704d8c69a1a12b29312b99ec0fd25608af07b3c79ea5a83d0492","ssdeep":"192:d61F3JpeOVXIhCBnMfJlUEpFX8nmuONy+2Yn:doF9TMsEzZuF+2Yn","tlshash":"5f1212ccf6c7f0055267bab5817b451ab33ebd1a244a4894f42bcdd5287c619a12bf38","size":9226,"data":"","first_seen":"2025-06-01T15:05:10.790294Z","last_seen":"2025-12-16T16:58:04.809767Z","times_seen":521,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/4v6vyIur.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"10c92c717f8762cb181545e7d2c6b331","sha1":"712d5130ad1deb5bae8e8e479a21d4908274dd34","sha256":"dfc421c8fbb78ff109f24399be0a334cbf47b3b407cf2bc5c31f50e2da4cd9a0","sha512":"34893e23627e8ef59a86fd8bec5618574feca8590438c4edd0f6f59efb2cfd25ed0b3bc334c2d4afe53e9e96f45ca65bb651f5ac475760cbcb269ac3a6c6eb23","ssdeep":"1536:QsrUHXu9+2FYnFjqN1q46HAXJF707AMvrHCRAxpdh5CVaJwBNI5tdJked5qK:QxHXuw2FYW2T5Sa1RdD","tlshash":"bed35f4b4e0c0e7a056217b12fada7b362acc07471dbc3e557bf82182375475aea279c","size":136604,"data":"","first_seen":"2025-10-04T05:11:03.528287Z","last_seen":"2025-10-07T18:16:30.112258Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b7ffd5b7408c1219fbd35dd53208e70","sha1":"87db90852ceaf58be691a8c2492353a5d76de059","sha256":"fb997fc9d5069092971ad25f0131258ced2c36bf9d313ad535de25ac5c36e70c","sha512":"4045a6bb31e36cdcd5d0d32b3a672004365bfe391ea66b11bf2d2ee96e2715105255f02bf2b442072b902e9f0ba7db465a5d4733ddf3b18378375de86f112d8f","ssdeep":"","tlshash":"633126cab36189126a97383b653b5344617326e61e0268a3f2260e447c2cadbd53375d","size":1677,"data":"","first_seen":"2025-08-09T06:39:59.161093Z","last_seen":"2026-03-24T20:06:00.342299Z","times_seen":47,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/se0nEqBJ.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"importedModule","is_inline":false,"md5":"45b84c2348d774f82d8c590b4fd62b61","sha1":"4cfe5c94be3b912aa45239c0ec16bbaf18e7d144","sha256":"d2aef44d67affd4beae60ae1146555d727c47a39613078bfd3282ac6cf7a03dc","sha512":"a2d49407527b6f3dc77cdcde891b7be568b9c4024690683281b20cf17b76d0ba7788574d7bcd1d04a18a025956984b11a70bea7262c899288ce06ed28c8df8fa","ssdeep":"","tlshash":"f431320c380960bb239253e094de044ee258bd617a6bc4c5e2cc7d677d27599dc8efad","size":1539,"data":"","first_seen":"2025-10-04T05:11:03.407247Z","last_seen":"2025-10-07T18:16:30.088067Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DXFcmPY7.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DXFcmPY7.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=VyQuNl9NQk94t6Jd; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-23dc\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 3839\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":9180,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (9179)","md5":"f35775ff648ec6716f2a297601310e96","sha1":"7305e85cbb919d8b85f3a5930e3f296b5e6fa785","sha256":"4511ce05d79359267133ee9e7e89fe59be13436a70679dacdf294e07de1bdc6d","sha512":"c81450c578ff1a8ef035a1d56429dd637b3533bde838720faf99a48ee0d1805b8f24567ecb757ca921606067907d517d04226b17383e91d3a37c4fce563a34f5","ssdeep":"192:XqsxSEFu6ZufGq++k5q2IkZQ+tOWwYpsTctY0ipgNE7oVKRpnKFEN:XhZ8fK+kQ2IkDLwYpfYZplOKRpnv","tlshash":"c212e9e473ac72aa59630dd12475481de434e6243b26f4d1f2ba38bab497c44b273f2d","first_seen":"2025-10-04T05:11:03.241006Z","last_seen":"2025-10-07T18:16:30.134044Z","times_seen":8,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtm.js?id=GTM-KN757LMM","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.72","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:34:17 GMT","end":"Mon, 08 Dec 2025 08:34:16 GMT"},"fingerprint":{"sha1":"71:28:4D:CB:A8:43:CE:20:8D:C2:D0:1C:15:47:53:FB:EE:1F:E6:6C","sha256":"FD:F8:A3:C0:21:C0:03:15:43:2F:C7:36:8C:50:6A:39:57:B4:06:6A:0D:82:33:AB:55:A7:80:D2:E3:79:B8:11"}}},"request":{"raw":"GET /gtm.js?id=GTM-KN757LMM HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\nexpires: Tue, 07 Oct 2025 05:13:47 GMT\r\ncache-control: private, max-age=900\r\nlast-modified: Tue, 07 Oct 2025 03:00:00 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 131028\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":386300,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (9788)","md5":"36f52237f6b35b30a53c3b26ffba0ff6","sha1":"270d1cfc6391a45e8c856d6887cb47069017b781","sha256":"a714b9dacbd4f8ee9be8a2b6f68b1df3d7f0b82a24c9b0f413ce4f16e3e02b3b","sha512":"1560e165aef1ffa16235c8f34780f78cc0ec5957621537a3b21d324d1853e64f1dcdfb7540272b1a1c7014052bba4e132cd9101f0132169f43d7db0cddf23cb1","ssdeep":"6144:ldx1rzFQtfctlmzMR/JUBWAc7zfdIv4teNVP:l5PFQtfER57c","tlshash":"d38428cdb3d6746643a3a478403f014ba17b68a2f84cc895f185dee52e74a9a4237f7c","first_seen":"2025-10-07T05:14:26.60381Z","last_seen":"2025-10-07T05:14:26.60381Z","times_seen":1,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/api/visitor/v1/configs/default?jsonp=true","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /api/visitor/v1/configs/default?jsonp=true HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 5566\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, must-revalidate\r\nSet-Cookie: WEBIM_LOCALE=ru; Domain=webim.ru; HttpOnly; Max-Age=86400000; Path=/; Secure\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5566,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (5566), with no line terminators","md5":"638d060432ecb93780d761ece2001dbb","sha1":"497f80e2de439a0b5260eb9448cdfb7f5195829b","sha256":"8a2680517eb60dd29259f47c0cce83bbb653cd5330ac747b055836e4578974cb","sha512":"b05c7c566357807d136f35df56d69d9cdf8f1b4e3dace8ca3b4c3981cf8fb5bde098bc0076680aea6792dd8547ad14c6e5c6be969f660fa02b5a490b8c1a52ed","ssdeep":"96:mXzMOTx4alggVgY+/Syo6ygym/WYH9XOc4U+4s/cQtW6CVgpcf:k1OVY+KH6Lt/WYHccwUQw6CX","tlshash":"a1b141b1d126003b16c56a56ed396a8f277492d2e740ef3e8f1c0817f38dab562437e2","first_seen":"2025-10-04T18:13:14.581015Z","last_seen":"2025-10-09T10:23:07.378313Z","times_seen":6,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/v/images/upload.png","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.847Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /v/images/upload.png HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: image/png\r\nContent-Length: 5607\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nConnection: keep-alive\r\nETag: \"68daf6ab-15e7\"\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5607,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 252 x 192, 8-bit/color RGBA, non-interlaced","md5":"7b5802fbdfcaff9ccd0826fa008c38ba","sha1":"bec3747315222740af2524067fdb193ba5cd3dd4","sha256":"455f8ff96a7775e51c6766e041b6d94f324729236e4f11cee602d5374d4c70e6","sha512":"0b0a952f2f4ee0b4db1f8d195fdbd81487e6c34b2b1d72a3fda1870c6d8eda43e4291e2a0cb5a060e75644ee6dbc2e1e2932aa10e1027b578d4691c87187b26d","ssdeep":"96:bJ/0V4UQ9C6HWpAK6a44RkRMeUkucxOx5QUR6eDJHV7IlH:V/2yHWpHiTgkucxI5QeDJHV7IB","tlshash":"7ac17cf769d8da9a70dfa9e043237872f8041b2bc6f0f356a8298097bf15c41f961301","first_seen":"2023-05-01T22:32:10Z","last_seen":"2026-08-15T23:16:20.915142Z","times_seen":2310,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BgUJLoS-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/BgUJLoS-.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=yohVisqaaBwKKZ4q; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=CWAEwJIBtPpbdAWQ; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-adf\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 1004\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":2783,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, Unicode text, UTF-8 text, with very long lines (2716)","md5":"3d2c02d74f4c0768d16385c23713a8c0","sha1":"1e2f8b6a1650552df13bd17f73f349846209ee3c","sha256":"8512dcb0a79df73db990833caf165aab1438ff109b77ddd32e991b8b0a69adff","sha512":"7ac5308be49ee81fff510e3d24e13ac74a8a6d69821206891d8e8a82542370041a96fb5012228d6288aa1c3892b3b4d6ee558d608c84817a858b19611b3b74ef","ssdeep":"","tlshash":"4f51421e7eda54310b2a2830e09714a3a009dad11c1dc721b9204d9d79b1d96cdb3fef","first_seen":"2025-10-04T05:11:03.439288Z","last_seen":"2025-10-07T18:16:30.141403Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/google/recaptcha/api.js?render=explicit","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ext/google/recaptcha/api.js?render=explicit HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=fTJ4DMruRLcVAJr0; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=BwPcwJlWLxT3wKOv; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"coop_38fac9d5b82543fc4729580d18ff2d3d\"\r\nreport-to: {\"group\":\"coop_38fac9d5b82543fc4729580d18ff2d3d\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d\"}]}\r\ncontent-encoding: br\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: private, max-age=300, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: Tue, 07 Oct 2025 05:13:47 GMT, 0\r\nservice-worker-allowed: off\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1060,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1060), with no line terminators","md5":"3af0043d752e1f849a37e90034b17970","sha1":"28b5a85d9651367aebf94b9db480376038ab03bb","sha256":"bb684f90e7c385ad69cd81f413a0c13a5a20ad2687475903b53d6d2e7833dbd5","sha512":"63c98400e269538ad3cfff737bd0ef881531941a7810a82606fb138f30c0bd93e86aa59411911f082f3a2be195653ddec6e893402968a52f1c1b2cd97dc4dbc8","ssdeep":"","tlshash":"1c111f731a18e0394b3219e1a2ffcb71e492701cf15845e8a556dad42e7adcbcf05488","first_seen":"2025-10-02T14:31:26.452384Z","last_seen":"2025-10-09T10:23:07.432637Z","times_seen":51,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/pwa-load-event.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /js/pwa-load-event.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=a2sVnhKeq3FlTJxS; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=au7JPBg5VsmUsPO3; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-177\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 164\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":375,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"f463b05f25296c1e185cc82087291f6e","sha1":"d15dfa009eaeeaaf36af83b20ace25714adbc583","sha256":"3f5bcf295bac81715b4413d640843ee19600f6a17c96503038c6a4193c331865","sha512":"5ecd0baa189383e24afadcbe391266fac63cdcdcb7da68ab1371168fae81f05f0140b4dcd86bc4cc59f4ebb3f5949e94b302f05de00942886fe3060436ae03bc","ssdeep":"","tlshash":"64e02b7483fc55b808e182b75f47bb15116721a77068d990c1871906f8d148780a2fd2","first_seen":"2024-08-19T15:07:41.99372Z","last_seen":"2026-04-15T02:03:05.836861Z","times_seen":94,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Br1FBsO3.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Br1FBsO3.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=utghdBXSQxVfFcO4; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-405\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 645\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1029,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1028)","md5":"767f58379d7921f95c8dc6c600a3df03","sha1":"13505dd414f4a7979cc3098535dd88e1e1ce193e","sha256":"fa877f9e586ac8365282757cb02e92b352649b7ee3f6cb33eb0026bb4f1c95e9","sha512":"57b4279a8e6d24ffa4bd77e6812666ea155eca8cb4fc3c1de0b42259393b937babb44298e1a70c2910ef36fbfc356c2e4aa32b36583304980a9e2f2fb98062f9","ssdeep":"","tlshash":"9611ce2bfa4a1b6263331c7646a931e6cf650b8b2c7994c43c54df261237c83e5a6f54","first_seen":"2025-10-04T05:11:03.632172Z","last_seen":"2025-10-07T18:16:30.14286Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DUaaTVgP.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DUaaTVgP.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=7yw9s6jLg3GBhvVx; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-687\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 929\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1671,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1670)","md5":"b7ffa89853e25cdd374f1b1b43dd9270","sha1":"0b818c53ddb47cfdfb2744f8885a52580139ce3d","sha256":"606f1e6bf95874e266928a81253820b7d84c7b825e49df2383961e32897c6b6f","sha512":"31973f15fc25c05ac174b2eeadf1f7a2a110fd9ef2df8c4a2dca421e8e3d51da6a7eaf1f8192f0f0e97e899d82d2eb17e80a74fe3a323f80c7b7ea632e3b1370","ssdeep":"","tlshash":"703144c9f29ce4b7d0e7d7e88472802076d875fb3fe8dbd5824099715623096764ead0","first_seen":"2025-10-04T05:11:03.445851Z","last_seen":"2025-10-07T18:16:30.060895Z","times_seen":8,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/sounds/click.mp3","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.286Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /sounds/click.mp3 HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=DoBJk4rNaEi8bHxp; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=6V1xX1us8GwZp9r8; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 6731\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-1a4b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6731,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"b497ee5b7f24d5540859a2fe9a2f94a8","sha1":"402f32b8a0c59a6655cee008020948c8b0dc3878","sha256":"627e28dd820dbe208a2d764c086b4eca2c54330b9741073bec9da852aa592962","sha512":"1f0e4fd80c187354ac665cf7e3dc52b8834ef35022c6fe922db3aae0f89f8530c5e97aa2d4860f2351c8fbf05ea2252593d626d12b8f90865b7eca6b6a476ee9","ssdeep":"192:79qf6EhSf0IotHNKWliJRgFn0DsEZM8+h/wgMgl:79qf6ASfCtHtliJ2F6sEZMph/w1gl","tlshash":"cad16d6a6d478951e40c5570d8ce1b4c737824b5afb0b3daa267f79e00e536c12ceb29","first_seen":"2023-04-10T18:19:05Z","last_seen":"2026-06-26T20:23:29.963181Z","times_seen":1246,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":87,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/l/v/init?action=init","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"POST /l/v/init?action=init HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 187\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:49 GMT\r\nContent-Type: application/json; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Webim-Version: 10.7.130\r\nAccess-Control-Allow-Origin: *\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1076,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"059f4c85628d18e44d247175792b94a3","sha1":"16ba73815538051348c4df2e388261dcf9faea64","sha256":"1cc8982837bb78c2aead0c9bf0b57dbe963b6ca4f3bad8bb2bfb02330db8a5d5","sha512":"33511bb1106acb71030fabd9c568bbabb4ae6a789122f3d15622bfad7b53932fc08df26cd276ad1798025d49920fbd643e3b87aba3901905437abfc1f66e8b24","ssdeep":"","tlshash":"9a11af69c4254cfb05c0606b54b006c3129cf213e3892a76ce589c66b3de6b6a71afb1","first_seen":"2025-10-07T05:14:26.618603Z","last_seen":"2025-10-07T05:14:26.618603Z","times_seen":1,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":133,"dns":0,"connect":43,"send":0,"wait":47,"receive":0,"ssl":89},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/w_DUq-AR.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/w_DUq-AR.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=P2BnnFNbAArbvrcv; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-15051\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 25826\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":86097,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4c6bce4ff408842b72be9810227b096a","sha1":"905b7ba6378ad365efc082783bc72ba90e804a34","sha256":"e8f8fa31e74b47742d52f5f9aebbd3220463ea110c472a0bf6d1bc44e4ea2d7a","sha512":"b2f00a387d36eb615467a74c0679c2fedac31af75325f6add5028027e538b0b419612738c6839d82cdc92a97c478d3a7da6657ccfa994d5a43fc7e8e67259bac","ssdeep":"1536:XK6l28I8DZzkXhvPS5uLEiMAa73hBlxvHB+CIdzkVXiA6w+EV93mBE09:66nCvPS5uZS8a9Q","tlshash":"c7832989f224b57782f75aca8376c20172a54984b809d4e4b0ed4d7b496e95c03afffc","first_seen":"2025-10-04T05:11:03.612073Z","last_seen":"2025-10-07T18:16:30.104994Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Chd1ThOZ.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Chd1ThOZ.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=yohVisqaaBwKKZ4q; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=3Mf6BBZeuaWFKnJO; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-47f\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 678\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1151,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (1142)","md5":"317a2201ef3851dba19e8b41380c8518","sha1":"69f8afc7452ae5bbffe308672417d74ea784cee0","sha256":"64cbae9ec71c97c3ca661b3a42c7f0de57972f702378830b7911e5a148b1cb0b","sha512":"4d8e02b904019b8bc965749301e7a14aa67543e54a8b2a19862be134620f94b55e7a2481c50590bf05fc5b7f6ce8e54746b77e238fa7b3a83fbaf81345be42c0","ssdeep":"","tlshash":"372130aebb3aa7bc7c245a5f42306f30f0132096ffb8945cb8d22126e3425a155640b8","first_seen":"2024-06-08T05:57:25Z","last_seen":"2026-05-26T01:50:53.816934Z","times_seen":119,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/button.php","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /button.php HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:47 GMT\r\nContent-Type: image/gif\r\nContent-Length: 43\r\nConnection: keep-alive\r\nX-Webim-Version: 10.7.130\r\nEtag: \"2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a\"\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"325472601571f31e1bf00674c368d335","sha1":"2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a","sha256":"b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b","sha512":"717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc","ssdeep":"","tlshash":"bf900003ea80c002c2a2c0300e0ccb802b88b0308a28030fb0fc3baeec3a3a20c23000","first_seen":"2023-04-05T06:29:39Z","last_seen":"2026-08-17T14:16:46.17756Z","times_seen":96971,"resource_available":true,"data":null}},"time_used":299,"timings":{"blocked":129,"dns":0,"connect":43,"send":0,"wait":41,"receive":0,"ssl":86},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/zVFskexI.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/zVFskexI.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=xt5OzTAJo4YjYL2P; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-132e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 1752\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":4910,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4909)","md5":"5ea5cccdf7fe73c144e70d799815d49a","sha1":"81bb06b30d93384c5161e2b6f8071ae99233346c","sha256":"ff9b0b00de6e591e7358f950969ab47c64969182cc7735d0f953a7fe2d85a70f","sha512":"48ae4ccbf48d353d4436238f7163e488638ee29f4049ba15a4ca4258a89a4609afb9d9563b4cdc56d88e7cb1d6e45c1d915309015410d38f6f716a35ddb961d2","ssdeep":"96:/SI0Lgam5pFjwsmyzqVBRJzxv7A28/s1/HEwYx+3cCL:/8mjsyGRFThSu/j4U","tlshash":"0fa1858f1240762e7ded4b5543f4681883304886fc1c27edf4ae5d389b5a88f61bb674","first_seen":"2025-10-04T05:11:03.358433Z","last_seen":"2025-10-07T18:16:30.125287Z","times_seen":8,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/games/casino/lastBets","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.285Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /games/casino/lastBets HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":45,"dns":0,"connect":21,"send":0,"wait":0,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/l/v/poll?action=poll","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:59.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"POST /l/v/poll?action=poll HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 174\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:59 GMT\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Length: 2\r\nConnection: keep-alive\r\nX-Webim-Version: 10.7.130\r\nAccess-Control-Allow-Origin: *\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-17T14:38:38.712515Z","times_seen":762140,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ls-cdn.amplitude/plugin-session-replay-browser-1.4.0-min.js.gz","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ls-cdn.amplitude/plugin-session-replay-browser-1.4.0-min.js.gz HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=7HPltmSLSzY7vLXp; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 07 Jun 2024 21:58:38 GMT\r\netag: W/\"ead49d69bc7839b0b873b096d418e1ea\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nx-amz-version-id: a9eB74QCYmN.zM7i5ckvNX3RYMk8LisI\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nx-cache: Miss from cloudfront\r\nx-amz-cf-pop: AMS58-P6\r\nx-amz-cf-id: kpHJdHONpXFqjh2ABC8diCIS8uVe8fhZT63NVun-qEc5mrHM5Uh2_g==\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":126923,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c19b1b5d91c8d683b1310562d9c4a225","sha1":"4d45dcac5c6a88e10052f4e356b2170c20413441","sha256":"bb5779145f1ebdcdee053876a4ed060174dda4656978972304c79ddd5f36dac4","sha512":"3a4e8d2e8f5d9a3b45c08ce99374c149a5b67d04d016edfe6259dfbbba948a049301c0cfa5f9bf334cb93b9b4a3558cffa725c166a943c90834c8d2237a1a21c","ssdeep":"1536:Ask/3qTBpVX0Ib6vhb2pJkuppl5METErM2jnpkDtoT1JaM18PIQunrr9gltn2BE/:IqBfX046vhb2pKMQt1Jawi697w","tlshash":"4ec329deb397b033539355a980bb0101b73a6a19300d4464f62ad9ea3c7d847a277fbd","first_seen":"2025-08-09T06:39:58.991299Z","last_seen":"2026-03-24T13:49:06.781634Z","times_seen":48,"resource_available":true,"data":null}},"time_used":849,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":849,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/api/v3/welcome-pack/get-welcome-packs-guest","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.033Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /api/v3/welcome-pack/get-welcome-packs-guest HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":17,"send":0,"wait":0,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/notfound.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/notfound.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/Home.puxSNRNF.css\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=uhPoUVvgv1R55DfO; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-4f4\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1268,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d407ca6493dfd5a34e7f79fa4504c402","sha1":"dd9fb47686492da351804b5826accf2524ab7dfb","sha256":"a0ac446a4d2979bfa2f6f73339f7087e6f7ff83435b3dd7f7b363c049b2c3bfd","sha512":"473308352777d8acb3d5d35275465ad7739729a4844908986ccd5f4e1041c0cf931cc328bf2c3f23035b218da4173afb835eeddfaf114304f5af1aaf3011c07e","ssdeep":"","tlshash":"2321b7f9932020d4dc075bf8dfa638d98007b9fa5e5002cba67471153308ccee401b5a","first_seen":"2023-05-21T11:43:22Z","last_seen":"2026-04-15T02:03:05.909912Z","times_seen":76,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":83,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/tp/header-tp-en.png","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/tp/header-tp-en.png HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=iBcuHoXKybPOH26K; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 4100\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-1004\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":4100,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 288 x 80, 8-bit colormap, non-interlaced","md5":"9984919a7ae4558c9b93a3e95e4d9e4d","sha1":"e511b73c533f649ce720ec8ea97c3a18ec58a29d","sha256":"77bf06a496064b8cfb7fd716c2abf4afaedee4c17e6c28d446a2ee6ab515cb16","sha512":"1c4ef457055489ecdc7832d0894adf6409492b59131d96f0b17ff3d1a799f22fbf23147054d64ac8cc55244d45b0be99f7691792ffad58897932818138ca75e8","ssdeep":"96:oEg9OzjOTFQiWpgoREKWT1uXWKqkD2EAvBJGagMf9CXq+V:3jOFQiSnRZM1+WKqCl6Gag+cXNV","tlshash":"44815ded0f971dddb730ad58526c00f1a52c2082b9b8fcf534a8f1ba7d2b22815d519b","first_seen":"2023-05-21T11:43:22Z","last_seen":"2025-10-14T04:24:50.196148Z","times_seen":37,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":95,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/eurostile-black.CuyT6JKl.woff","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/eurostile-black.CuyT6JKl.woff HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=rSCOhTY3BPjff4x9; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 95720\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: \"68df7ca1-175e8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":95720,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 95720, version 1.0","md5":"ca7fd9425338588d941bfb331792ecce","sha1":"e4a8a3b0425a3323f2c3e8b4059a1429da8297ce","sha256":"cbeec4e4387480fcc4cf1bb7f9bd5736f9b6425ac6d7450770e3bb565eb4675f","sha512":"8e1fc6495d11f4c2eafaa8fd62112e0517c2f5046b9777b8fa0f771c481f72a0f73db15a7f6797ed1523d050886f9fd7635adbaac124fee24cdaa8b86e935eec","ssdeep":"1536:jj302uG3KgcImTEjOwWoiGRHIRRBCUo7zO102Y0OBGYQACp2ZPC3ZZ6p8rR:/EkKTImyWoiGRYRBVoR2Y9BCp2BUZ6pE","tlshash":"d99312eec0fcce88fd9d02ce105d6a35ae49a0fcb2c3598b82f154d892dd17e895506d","first_seen":"2024-12-10T17:19:34.260995Z","last_seen":"2026-04-25T06:32:47.440262Z","times_seen":55,"resource_available":false,"data":null}},"time_used":316,"timings":{"blocked":88,"dns":0,"connect":0,"send":0,"wait":112,"receive":116,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/b-vBzq2i.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/b-vBzq2i.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=lIKox3R2t8EwM7cL; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-d13\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 1270\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3347,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3346)","md5":"36c0c6b8ef144d7bf7caa7079c3a416a","sha1":"8dd20af034fdbf41e59ffbc3aa163434f7ee366a","sha256":"3680ac7d48ce5a8a0c9fde6d13412fb8edae11c7de9830872df097f8aedc5abf","sha512":"927260065160a49bff0120fc290821cc672903ea0d9135823628640c37dbd0e28581b0266cf1d189d1eb33fe85ae593c49035d3bb673b31857c5a49d2903913f","ssdeep":"","tlshash":"856141fc1635a57226eb17bb43620ca242764845f049b27010da8f0d592dc984bf3ffa","first_seen":"2025-10-04T05:11:03.465869Z","last_seen":"2025-10-07T18:16:30.055353Z","times_seen":8,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":17,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CYqDhD_K.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CYqDhD_K.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=7m0y0aj4nou2psfr; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-4b83\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 8159\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19331,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (19330)","md5":"1bbfaa6ac14a0d4a4f6a2bdb50403740","sha1":"da1db6943edc34407d541bf0999bebae565a73bf","sha256":"75a2ab6b9337408f843fde1e6ecf53fab99814a48dc12f1744621095a45bc852","sha512":"585e1e94ae1be8697cb4217da30bc9a3c01726a9e4ff4664f8a888ea03fa639d8a97d603f95684fc8f37b006f0ca6b67619a74114c7924cfb1d8a1646781c6e2","ssdeep":"384:gbLmDw0GjHIVo6eR6o1Shl449OsLV5jbHQ6NhWWxZ9HqDXRoOkm4Zes:gPmDw0MHIVo64X1NdshJTQ63WUG4h","tlshash":"479295c832c7f5968793197681bf100bb23e6d85a40d8892d53ae0d87c7486c867bfed","first_seen":"2025-10-04T05:11:03.43668Z","last_seen":"2025-10-07T18:16:30.136146Z","times_seen":8,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BbqPNdSU.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/BbqPNdSU.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=Z5621C817f0ushcG; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-21c7\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 2751\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":8647,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (8646)","md5":"d41b27ae63a30ec5d67cd47eabe3049e","sha1":"d1c10551d8dc1c36a70afbd414a0536cf64bc8b5","sha256":"d15f6a0302235ea1ec65d60e9c153f9edaf3344ac40599380885512fe83dea5c","sha512":"44f9246dede1ff1a1665f88dd0042c43ecefd28cf64dc01d4b34d60c88b6fa95255cf0185582c3c23a88f8edd54fb01d8e47576c7aca101ebc167b8de3f2b05f","ssdeep":"192:tXiFojMIZjkItgj6pnaJe/HA9iReMDjHMtpgCtAoRXSAd55rD1W55Jr0UWip8W4a:xiCMIZjy0LhYRHMAhPMN07i6jC","tlshash":"1c0240de520a64b00bd706fa81e846d0d6b00844f04d997c64f8dddf477ec8917a6bbe","first_seen":"2025-10-04T05:11:03.58126Z","last_seen":"2025-10-07T18:16:30.056453Z","times_seen":8,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":16,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/se0nEqBJ.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/se0nEqBJ.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=3M8ysaZTZRPIYh4y; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=iPnSWaNEzysvpA2A; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-603\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 854\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1539,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1538)","md5":"45b84c2348d774f82d8c590b4fd62b61","sha1":"4cfe5c94be3b912aa45239c0ec16bbaf18e7d144","sha256":"d2aef44d67affd4beae60ae1146555d727c47a39613078bfd3282ac6cf7a03dc","sha512":"a2d49407527b6f3dc77cdcde891b7be568b9c4024690683281b20cf17b76d0ba7788574d7bcd1d04a18a025956984b11a70bea7262c899288ce06ed28c8df8fa","ssdeep":"","tlshash":"f431320c380960bb239253e094de044ee258bd617a6bc4c5e2cc7d677d27599dc8efad","first_seen":"2025-10-04T05:11:03.407247Z","last_seen":"2025-10-07T18:16:30.088067Z","times_seen":8,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DzVxT-JT.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DzVxT-JT.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=yohVisqaaBwKKZ4q; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=QIOuE6ysZXTccHn6; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-8e6b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 9896\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36459,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (26664)","md5":"56b248e4197f0aa4ff0bf9e1a5b45b46","sha1":"fd106eaaf3c02a1a9fd4885d893bd1970db2897e","sha256":"636935d6e62f931bc653ce0b948508d6b13dd6967c2b278ebc0cf8e81016773b","sha512":"cba0682b45dea2fdd1828dbc2d87bc1caa950b6f1a3837281662cf896660c76c8c5560bd9f60302bf997691a60509971c61b5cdf8d7d307ee589da79f2fd3133","ssdeep":"768:4qTY+itM+orCjJJy1ee3JP6r1KCcKlyUW7YC6u64tH/9:jbiJou3CP6YhcW","tlshash":"a6f21a487be0bc34c29a30d7353e09057b726641586f6600e009c6b97fa968a71bef7e","first_seen":"2025-10-04T05:11:03.531109Z","last_seen":"2025-10-07T18:16:30.074352Z","times_seen":8,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C72coOWc.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.681Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/C72coOWc.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/CkMSVCQx.js\r\nCookie: __ddg8_=ecNz5j6xDjGmP4xJ; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=WckjYPrAUsF1O5Zq; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-56e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 862\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1390,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1389)","md5":"f3bc6cd8453440a2112d76ab82bf7bfd","sha1":"af19e1d374dc436237a39c274cc7162326a03096","sha256":"d2f31fedab9f60c9f48cc734c847add5835557c2d4aacbccc3d1ed8794562a8f","sha512":"7f68ed63cfcda6c55de267e2e26029838317ccf504652ff4c2659492711864100aa52eb5722688d7d6a65efef4897edf1bb6a1d9c8e4cbdf225971f1b8ac00f4","ssdeep":"","tlshash":"ec21fe4fd000d03941aa8df8e069a92163b352ef03e9d6b5d2ee0e750b80025c14db1b","first_seen":"2025-10-04T05:11:03.629959Z","last_seen":"2025-10-07T18:16:30.085382Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DVB3Cdql.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DVB3Cdql.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=rZz5Roym1k11azjx; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-82db\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 15061\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":33499,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32971)","md5":"20eed75093de2fc9d2444246aefbafec","sha1":"4f36aff0a4fe6f29e8db087ce85d2caa85dc3f4f","sha256":"fd6447eb787622249c366ac85f7ac12f55a700865902fdf1a5b6dd6997096769","sha512":"a11c3328cbef91f50466b6d9c8b4b01d21e125ce99a87a5ee73e296f08fd6f81f72a1bb79f7ea9800f09266f2b04d48ddf49905e6d60dc5d7cf899cf8417a0e5","ssdeep":"768:bXU8MMca080Hjkh5UyvucDYxhROs9SewPpUzSsLP20+6a7kHGQPLFODM:OI088a5bvuc0xys9SeSpU1Lu0+67mQhN","tlshash":"7ee2c6cc7641b018a3a711b6e1ef580fb37a2984980e8554a0aef5e43d7c4bd43abddd","first_seen":"2025-10-04T05:11:03.415244Z","last_seen":"2025-10-07T18:16:30.105627Z","times_seen":8,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/middleware/mirror","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.036Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"OPTIONS /middleware/mirror HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://www.gwdt26x.life/\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":21,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes.min.js?v=1","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /cryptojs-aes.min.js?v=1 HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=WT25ruvGHQUvHS3r; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca2-359a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":13722,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (629)","md5":"cd93b7f0987a614bc17698503bcb6af9","sha1":"68a66448326499ff34c75bf31e2769b278584e0c","sha256":"8d4fae1a37a5b5338c889d0897b50024194b4d3ae94940e7e42c1c1423a1183e","sha512":"e3b87dfe10c0e3f3d801a85ae9c654a74eac22c2a93a757568a0d2b13755c36aeb5f9337e94a21db4ef2d1f0f1cfb98fccbbb0151d5cdf8d967730df96bfde98","ssdeep":"192:9BIGDmDm90mP9z8Ui015lN1I5rI2Tru6hMJFmHV+mdpwIfyAaYfKnNVYkUUFJZm3:9yiB0ez8UiIX1SrTegsEHJuI+y8Z7AX","tlshash":"625297c936edb94263963028587f6017b86b28b6945c4824f29cd4ddff9899dc03ae3c","first_seen":"2024-11-30T18:08:34.076577Z","last_seen":"2026-06-26T20:23:29.818692Z","times_seen":1206,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-VRDLWS0SHC\u0026cx=c\u0026gtm=4e5a32","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.72","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:34:17 GMT","end":"Mon, 08 Dec 2025 08:34:16 GMT"},"fingerprint":{"sha1":"71:28:4D:CB:A8:43:CE:20:8D:C2:D0:1C:15:47:53:FB:EE:1F:E6:6C","sha256":"FD:F8:A3:C0:21:C0:03:15:43:2F:C7:36:8C:50:6A:39:57:B4:06:6A:0D:82:33:AB:55:A7:80:D2:E3:79:B8:11"}}},"request":{"raw":"GET /gtag/js?id=G-VRDLWS0SHC\u0026cx=c\u0026gtm=4e5a32 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\nexpires: Tue, 07 Oct 2025 05:13:47 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 129717\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":375596,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6031)","md5":"ae80a05830c5e15ed5b7bed1b4c297e5","sha1":"565a22ceb998989e3c6f013d689d95cd7ab55ccd","sha256":"c14f3f71304d803cc4514a5c303246b4e5befe18e5dd05f56bc5aeee50af0a2a","sha512":"d2a82ab1c448a1aee1eee1ff77dd47485d29b128ff061d213c1beef6156f97359ef43b8c0a7ac98753b84c45774b9170e33da2b62d388450504edaf709c3c93b","ssdeep":"6144:Amxhrv4FZtfctlQR/cBWAc7zfdkpbbnWOUqgwLMP:Rb4FZtfLRPK0","tlshash":"4c8418ce73d670225396b478503f018ba57b28a2f44cc899f189dde52e74a9a4237f7c","first_seen":"2025-10-07T05:14:26.641496Z","last_seen":"2025-10-07T05:14:26.641496Z","times_seen":1,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":36,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/analytics/pv?pgi=GTM-KN757LMM","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"POST /analytics/pv?pgi=GTM-KN757LMM HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 495\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=tySZ2DdjxraAdiMC; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=c1hQoqy44OyWmVrK; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/roboto-bold.BeRaP8H0.woff","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/roboto-bold.BeRaP8H0.woff HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=y0hgp44A2fy9JReb; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 141532\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: \"68df7ca1-228dc\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":141532,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 141532, version 1.0","md5":"ba3d7f35e4e84772d778ced098c5a40c","sha1":"248262cc71832afb331a103116b8a5f061693cc3","sha256":"7abf45d601fc5dbc8c482c9cf62916b8463b14d4d9a90e0b5888952401f784e5","sha512":"6cc5d27fdd4030a66cde525d52c9cfebc1a2caa3ebe10a49b538694cba096fdc7ea57f2c4a2ea153bd102885cdb9e92d8c5c129dc38251be93bc6426ada89a4b","ssdeep":"3072:4SGRte9oLIED5Zc02YQeQDKyY6s10mehsr4QIaw545V:2GYhX27e0Jl3s7Ii","tlshash":"fbd3229fd04ca4e2c57fb6e1c4e74ef0a5b53cb6d10e358f1292c9118207ab9e8e6649","first_seen":"2023-04-14T07:00:11Z","last_seen":"2026-04-25T06:32:47.439749Z","times_seen":64,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":76,"dns":0,"connect":0,"send":0,"wait":91,"receive":155,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/games/casino/common","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.282Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /games/casino/common HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":0,"dns":0,"connect":21,"send":0,"wait":0,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/v/images/default-department-logo.png","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.848Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /v/images/default-department-logo.png HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: image/png\r\nContent-Length: 15479\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nConnection: keep-alive\r\nETag: \"68daf6ab-3c77\"\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15479,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"53a142e29b647ceba5a2adf6cc69b919","sha1":"37fc7f6523e5f4d9e01157c70acc74069bfff416","sha256":"a5b367cc08f01ae61da2109c04047ee7e218df860be597c35d4ca7e064fea63a","sha512":"898a79097ada980f99bc1fe495cf55aa54050d286e108e9fec3f1e53e75b0a88e650a53bbae8a5b0c708f227367b3b193c45103c482e71066a9c0a8988aca61e","ssdeep":"384:Vk8Swa5Qg42uLHe77h+CnqUMfgFvywxTcFOid/BQkrO9okl:ONwa5QgRuW7UecFOi8krO9oU","tlshash":"7e62c0eddc7f24cfbcfa527e1d9d0c1e4d989e240170a8f64ef3d49a4821a66d5029e8","first_seen":"2023-05-01T22:32:10Z","last_seen":"2026-08-15T23:16:20.92518Z","times_seen":2309,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":36,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C28Ks5WD.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/C28Ks5WD.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PRWAqMjBJvrAhwnS; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=tJRxcKZpaaXaD01h; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-34783\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 53775\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":214915,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (62123)","md5":"226f97aae05b1bc8517bf6e8357b2035","sha1":"ec26d9e8486f92c5be054c7bbb23c607efc40016","sha256":"3a540feffb54425661775040e9d000fc91c8541e60a10d28b4916048e20d7c69","sha512":"a3f3fe091a35f13546658cfc513bdb66fc91a4fc90794d5ddfb88b64b6291a59029695134bac483280d8e88206b6497415122e156c68d87abd6a8324435c4057","ssdeep":"1536:7oDsoGxvPYALxa1k9CdeIusU1aCrhquwRpeQIvkn459rS90dBuwRp0r1GcJwdAfH:zZxvPY0L9sMawdAfGvM","tlshash":"03247daee38690fde12b8794a44b381431752ffea681cc8381fc5d0466268fc57ede65","first_seen":"2025-10-04T05:11:03.298502Z","last_seen":"2025-10-07T18:16:30.073415Z","times_seen":8,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/TaNftZks.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/TaNftZks.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=nJ8StwHxrxYf2j8w; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-9018\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 10066\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":36888,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (36844)","md5":"b3207d6a426c185b2a7c5287a16b3b54","sha1":"ef943c31a4709da3cb206379185f4a9298596fc1","sha256":"e5961afbf67e5c460e4a76fbab2ea44d2c538589da9053ecf5ddcb80bd9f16ad","sha512":"6459689b5cdc1c610512d2f364f44c886d41e88ea43170f86b80d8c876b31bb8af2ffa391565414c9827d27b907f8c96fbb043ba29325403b4f764686892c940","ssdeep":"768:ouDRAWjwR2qMm7t58Om4uSyMUWLucH4YrjjiYHNzlchq15lDVtkIfrH5J1Le6VjT:o7eDmpiSyMUWLucH4YrTlcWRf7HuK0de","tlshash":"00f2d709e4199c3ed9b78dd878541402722d2fdfd0804d72a2fc9e155bbbd78229eb6c","first_seen":"2025-10-04T05:11:03.548498Z","last_seen":"2025-10-07T18:16:30.09333Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/geo_ip","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.945Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /geo_ip HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":1,"connect":22,"send":0,"wait":0,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/bonusWagering.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/bonusWagering.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=vhCLAsOELrBqT3SI; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-652\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1618,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6630c9a6d86e7827d983c8afd4f3c47c","sha1":"6d52149d8636231b07cb30c3da8f7549410edca9","sha256":"2ec295a534e212461e58cf5dc3048ffd1207a417f03be96c22ff0f2a0462652c","sha512":"7802023b06e8452ee55427dacf6914bc7bc7ab0695a974a031f0a68e2b14a3b2c7b5423fc8748a852f5ac8c43ffdf545ac9dcf9ba5959f385ce9f9dfe7a96f10","ssdeep":"","tlshash":"7931c2faa2c4e6f19f436392c8a0a038f74b106637580f94a370d7d9fb7a05d4a49cd5","first_seen":"2024-12-10T17:19:34.230323Z","last_seen":"2026-04-06T22:48:49.699125Z","times_seen":62,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":91,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/vip/mainPage/vip-logo.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.208Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/vip/mainPage/vip-logo.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=1XDFuYGq1TUZhJcx; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-135b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4955,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"15326d24a9c9c1179319a40491a77f20","sha1":"38d1265be366aa25f026d0401f349b1c33459ae2","sha256":"25705fa2dc626c00e80884d3f5169ad4f5ec2f9c6627a0e178747c2f1d78bcdd","sha512":"02b94b969ed3cbdbd99c262a3f8751a01e679e33bf0a844d63c595ae92d557e69a44cab9923f6073c8527d235d2cd1ab068f8bf111b6ea2bed89e28013ae3785","ssdeep":"96:LsShqhVJHu0qUm07P5dm32k+uBdG8h70e9zAzoiboIqlhxFp2jU62I:ISsx60/m32kBGxYzAzHqBFpmmI","tlshash":"e1a1baefb7759df4e885f3f8456500147a6728b738a0ca38c3a07fd9aa8529e9d44cc1","first_seen":"2025-08-09T06:39:59.041692Z","last_seen":"2026-03-01T21:47:53.355466Z","times_seen":39,"resource_available":false,"data":null}},"time_used":93,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/footer/lvlx/default.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/footer/lvlx/default.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/default.0Z-hrgpm.css\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=IKOUjcXZWzsFiFBB; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-131f4\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":78324,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"861bc0fbfe9e67f911533676dcdc95e4","sha1":"711166d32abc201afa9c14ff03b0cb98d4e4e35b","sha256":"df69d312fe8509a839802cd82fbea21cd863aaa4ce8ffa08c99fe0cc19cf2356","sha512":"1688c6f57916f56a146dc129ffaa617cc9e74eff2c46b431edbf8a643fd3f2bb81579afbfac3ef3f5f7d4049e452ba0966ca24b3481433438c32e5e56aed7648","ssdeep":"1536:wc/a8s+S0v+DRGkZHWQwaESSt7hSZBwmsAuppsPV+HJM33iM:5TK0TJ4Zmm10q","tlshash":"e273c7dc6bb405f0dec593daae2908a97c2765fe2d815d28c21c5f842ca1e6ccc65dca","first_seen":"2025-08-09T06:39:59.049635Z","last_seen":"2026-04-15T02:03:05.856061Z","times_seen":68,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":60,"dns":0,"connect":0,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BR0LGmbo.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/BR0LGmbo.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=Qkoq0awwpSp4tPq7; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=tr79favJmSYRYGaX; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-1a5\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 261\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":421,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (420)","md5":"6f2b8499fecb463aba8caa6a41f9d51f","sha1":"8d543cdc97fca1a30239569204797c44555b2569","sha256":"a93381e56863d96d377acd7917ab07625ec810a3ddb2ea1b5dd970149dbc64d9","sha512":"ecce6ab9d9b797ac5ccbf5de6ed0068e603ca0232e5bf0875d2460b5749b5baf86b3808e758fd5fd50443427d5cca0340be85a8c0b05dda6a2a13f798c2d5a8f","ssdeep":"","tlshash":"34e02b0eb814c1b2a1679de8c171252216147dad73a4b1c2818f562157251aea14eb16","first_seen":"2025-10-04T05:11:03.462592Z","last_seen":"2025-10-07T05:14:26.653197Z","times_seen":7,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/entry.B0BOi0i9.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/entry.B0BOi0i9.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=ba6AH5ztQsGn3yR9; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-1080\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4224,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4223)","md5":"61f0bd26cea7d117c5e7c486acc68d00","sha1":"6c8bcb0f1c4f0fb0f07276c5eacd898124ed10df","sha256":"f099b430b92e0f00145cb9382b4a9ae5fd988a1e4f4bfb3043e5a938efc4ee39","sha512":"f9bc1136e2349b7ac1471ec7801d8047312f950e30808796e33dcc45bdf4cc68b709d9a30c6ae3f2cc7371b4d47bd532b8cc59e09569e52f1d9a1b30cb0b91c2","ssdeep":"48:qBK1KVrwxo7yXr29OKJgbKA7cb2XYKBKJKeKbKaeEaSkeEnS0SSSWS8VSfHeEPeG:qxi8yK9RHN4MEBWWXIShv7JRhW4D/qi","tlshash":"4491ff7fb288f6580127ff02a4a15bddf42b23b0b2522a15f2d5523061b67d1bc29d7c","first_seen":"2024-05-30T05:56:49Z","last_seen":"2026-06-10T14:34:42.966261Z","times_seen":189,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/projects/233e4c5f9379d04ec864/settings","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ext/cdp-customer//v1/projects/233e4c5f9379d04ec864/settings HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=ifRSlUc17inOJ7tI; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=LhI0qLBDD4z7y5O4; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: text/javascript\r\naccess-control-allow-headers: Authorization,Content-Type\r\naccess-control-allow-methods: \r\naccess-control-allow-origin: *\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nservice-worker-allowed: off\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":271,"size_decoded":0,"mime_type":"text/javascript","magic":"JSON text data","md5":"12c4ca482e1b7bf40375503843b5f997","sha1":"49d40faea70af1183b0ffb901b2a31da7df67e00","sha256":"3476d8f31024437417c5f09513e2917124968baedbe03b67e65610ab25bc6b11","sha512":"2ea63ebe73591d6db25a6ab54c245b29b4eed22ec8827abc39b4db69b79207dd04689cd6a9257ff94145ced2358ff3e66a31e8e6aa672805960387df8e5e4e26","ssdeep":"","tlshash":"6fd0c28c25701dfa88d16e798b9c5809b5cfd62d50a59b097574cd800dc08f82a246b4","first_seen":"2025-08-09T06:39:59.043609Z","last_seen":"2026-04-06T22:48:49.753298Z","times_seen":65,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/se0nEqBJ.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/se0nEqBJ.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=bPlJaIVheX3zZDWH; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-603\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 854\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1539,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1538)","md5":"45b84c2348d774f82d8c590b4fd62b61","sha1":"4cfe5c94be3b912aa45239c0ec16bbaf18e7d144","sha256":"d2aef44d67affd4beae60ae1146555d727c47a39613078bfd3282ac6cf7a03dc","sha512":"a2d49407527b6f3dc77cdcde891b7be568b9c4024690683281b20cf17b76d0ba7788574d7bcd1d04a18a025956984b11a70bea7262c899288ce06ed28c8df8fa","ssdeep":"","tlshash":"f431320c380960bb239253e094de044ee258bd617a6bc4c5e2cc7d677d27599dc8efad","first_seen":"2025-10-04T05:11:03.407247Z","last_seen":"2025-10-07T18:16:30.088067Z","times_seen":8,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CFzQcB0L.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CFzQcB0L.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=yohVisqaaBwKKZ4q; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=Qkoq0awwpSp4tPq7; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-39e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 331\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":926,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (925)","md5":"e03518ae3241e6dd395a063ba226f056","sha1":"ce8d73c397d5dc7ee93d3f441458d108201216c3","sha256":"5d716e4a24b41b70d9761f4ae2cc82b40a9e511e6cc6b8928bf37c1d61fc6ef6","sha512":"3de9e95ab046329789ed32f1404e4461988c1ce6bc41d1740d7c73cf1a87f4b802920111f593f14038981c80deb5d91190e6de0ba5f867f5b2a7d6b1062d6c60","ssdeep":"","tlshash":"3b11344e90351e9dd06ccfba806af38330609dbb2713e0597919d1a43eda4034d28f32","first_seen":"2025-10-04T05:11:03.43181Z","last_seen":"2025-10-07T18:16:30.089715Z","times_seen":8,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer/v1/p","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:50.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"POST /ext/cdp-customer/v1/p HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nContent-Type: text/plain\r\nContent-Length: 710\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=tr79favJmSYRYGaX; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=KBG9tyFJAz66GYcx; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:50 GMT\n__ddg10_=1759814030; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:50 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:50 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:50 GMT\r\ncontent-type: application/json\r\naccess-control-allow-headers: Authorization,Content-Type\r\naccess-control-allow-methods: \r\naccess-control-allow-origin: *\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nservice-worker-allowed: off\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":16,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7363e85fe9edee6f053a4b319588c086","sha1":"a15e2127145548437173fc17f3e980e3f3dee2d0","sha256":"c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97","sha512":"a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85","ssdeep":"","tlshash":"f0600003000000a2c000220002382e202080002280000008800c20088a20000208300a","first_seen":"2023-04-05T04:17:27Z","last_seen":"2026-08-17T14:41:38.734248Z","times_seen":183019,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Home.puxSNRNF.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.656Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Home.puxSNRNF.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=JrkLqISG1OoCRa1A; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=kDP1trVAByuzz1a3; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-7b70\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 5466\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":31600,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (31599)","md5":"f54b3d372981eeb830226b2cac6589f8","sha1":"5b32f6d7e1051ff1b13ef9ea8ef930004026f974","sha256":"702d9e1a9127a29bbf7a76f83f5239bb9bbef44c0f8382b79f13a38e5cd63681","sha512":"6d226b5103d1ac7895a65ec95731c3535e1f7850ce9e6c9e50c0fce4224413bd964e485e4c5ce1c686a466b23727d11d32dd712b9823a07289388c8fb030bed6","ssdeep":"384:7c9CVetr9K8r9TETMutXaYHsYCsk7JWGCIEw5+22xI:+CVl+9gT5sYCxl2xI","tlshash":"5de29931671c202db1bbe676b8e16a9d6118f507e72317b9d5d47438c8db682323aacc","first_seen":"2025-10-04T05:11:03.609866Z","last_seen":"2025-10-07T18:16:30.052681Z","times_seen":8,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/games/casino/statsGames?limit=4","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.282Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /games/casino/statsGames?limit=4 HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":20,"send":0,"wait":0,"receive":0,"ssl":102},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DlAUqK2U.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DlAUqK2U.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=1vCACxH1rucOQrFC; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-5b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 82\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":91,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"25e3a5dcaf00fb2b1ba0c8ecea6d2560","sha1":"7850b3fd4aeb69387bdb5a60025d15c41351d5eb","sha256":"cb85b0f263dbe24e857338301c0627076592e9f1f1a5662929f86d2c126444aa","sha512":"2e5cc9b53d5641147f68c73e5db0442d93fb6a64da45cfc051da5550a2fad07e912e651bd730e54325ef74eb706be0c5df612355c1dca144ab6e9cc8c4ecc73b","ssdeep":"","tlshash":"1fb012c81cc3e078939818d47738c15844380448310742b0808c0943e2c20809797c1d","first_seen":"2023-03-08T16:39:49Z","last_seen":"2026-08-17T14:42:22.540243Z","times_seen":25631,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/footer/logo_mini.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/footer/logo_mini.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=4gClStcSV86LtmSG; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-153\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":339,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ec921737dc68bdec198dbf790cf25066","sha1":"7783777f39dd0406bf43f29691d5a297b6cdb254","sha256":"afb8137f243326318186eb1680a2f30d060004621a320a6ca93b807ec16cbb9c","sha512":"ee0a8cf1b8f8f28432ff245b02d211d6cc29d22fd55d60ac70ff126fb9b28a704bc862e2b7ae10027554b50b03ed73ee48e7f373f862ac8edac89350268dada7","ssdeep":"","tlshash":"00e0c0c4616833d090100768cf7f6165a5e2f4ae035c044bf2903115b215fc7a062b08","first_seen":"2025-08-09T06:39:59.047675Z","last_seen":"2026-01-21T08:18:57.02182Z","times_seen":36,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/games/casino/currentGames","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.284Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /games/casino/currentGames HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":43,"dns":0,"connect":20,"send":0,"wait":0,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/pwa-load-event.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /js/pwa-load-event.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=o39JkUQovNA7am35; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-177\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":375,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"f463b05f25296c1e185cc82087291f6e","sha1":"d15dfa009eaeeaaf36af83b20ace25714adbc583","sha256":"3f5bcf295bac81715b4413d640843ee19600f6a17c96503038c6a4193c331865","sha512":"5ecd0baa189383e24afadcbe391266fac63cdcdcb7da68ab1371168fae81f05f0140b4dcd86bc4cc59f4ebb3f5949e94b302f05de00942886fe3060436ae03bc","ssdeep":"","tlshash":"64e02b7483fc55b808e182b75f47bb15116721a77068d990c1871906f8d148780a2fd2","first_seen":"2024-08-19T15:07:41.99372Z","last_seen":"2026-04-15T02:03:05.836861Z","times_seen":94,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/apple-touch-icon.png","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.800Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=fTJ4DMruRLcVAJr0; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=GFxSUAsVeWCETL97; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 5476\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-1564\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5476,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"b0fd6219c3cc6542ac16de5fb1a803e5","sha1":"32e23eec5c195ebb1288a30e3eb88fabef54d68e","sha256":"3de26349c4bfab8a20055a516f6a01a3e26870922b5e158d25b222150248bb9f","sha512":"ca31b6c5eed2c86716e420501bba2bd940b0b74627e9acf6c535e1391dd518851aaa699484966b2c9b463af4b84fea8a91072966e6d355f12e7bbd7e04b724a8","ssdeep":"96:TitXRWWOLtp6cCMcakSchLRel2CgQ+dwmcwveg4tjvR8VRtvS:TUoWOLPIaihg29dwAv5Vi","tlshash":"b0b18db839459902eec1e13923565bd0af3111a036012c4a136fc9375b147a23abbfdd","first_seen":"2023-05-21T11:43:22Z","last_seen":"2026-06-26T20:23:29.98019Z","times_seen":156,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gwdt26x.life/api/mirror","fqdn":"gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /api/mirror HTTP/1.1\r\nHost: gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=VOGqeFvMVF2YWsmT; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg1_=7tWzFAxEIyydKmp3uhON; Domain=.gwdt26x.life; HttpOnly; Path=/; Expires=Wed, 07-Oct-2026 05:13:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: application/json\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\naccess-control-allow-origin: https://www.gwdt26x.life\r\nvary: Accept-Encoding, Origin\r\naccess-control-allow-credentials: true\r\nx-request-id: 06596c12-704b-4a0c-8e4e-fe865d15973c\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-fastcgi-cache: BYPASS\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":538,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8f08d65512f633aea0fc47730b1d533c","sha1":"01122ffca990540570c20e9825967be2db3cb188","sha256":"da85f90368fe77c6a415cca8da0589cc43e2999c79de3bfec4bcffeea80ad0df","sha512":"f17ad28c5591aadd0a399eb9fa1eb595208ed9ed3826a7bc0e13f6fbf1bcdc2d1bc0df84e2a42af4c487815b8154c85f2497e679010557ec56b1950415928dda","ssdeep":"","tlshash":"19f059522ea69e2c02ca53c50d18bcaa96dd910ba811acb54d98df8501f82f4613b026","first_seen":"2025-10-07T05:14:26.661292Z","last_seen":"2025-10-07T05:14:26.661292Z","times_seen":1,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Icons.DcXG4f08.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Icons.DcXG4f08.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=ifRSlUc17inOJ7tI; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=grEvfmwDVYyncVER; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-2ce\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 166\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":718,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (717)","md5":"676827eb558cf063ae766720cb4d5f3c","sha1":"6c2d0a4e8ef98fbc7a74a7c1dae9b16408fa75c2","sha256":"06c154b48333f56cbf15f9e7226c90ee7488ec9c4f56bbbbdadad36e0e8fab0e","sha512":"b31196631bd64a9347fd27239a4cab44535052ecabf0141d3809589851776990589ad8c9aba10c548da7ba7bb441c89e381bedb92dd81e56999311591c6916c7","ssdeep":"","tlshash":"ef01df7db65ef94b533bca0ee24c002311ea77a7dd418180228bb836b97a760381f073","first_seen":"2025-10-04T05:11:03.520159Z","last_seen":"2025-10-07T18:16:30.102849Z","times_seen":8,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/v/images/file.svg","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /v/images/file.svg HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 9286\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nConnection: keep-alive\r\nETag: \"68daf6ab-2446\"\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9286,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d6d4ad1349f997af8f4bc6e45fc6d2ed","sha1":"7908555e4ba3d3c73eba84266f800120c43270e5","sha256":"56d45428cf96355b298c7f5c023ab7c004583b2a136af450968c55e1486e2453","sha512":"1e011720c337271c89a7571cf2a460d07fc075c54311d2707768a43caadf966bf410349bb62eac2db6e729c48d0e290dbdf477d3a347ac3cdf4c1333cffeed3d","ssdeep":"192:C3ISknUnObdnWlZohOWCXQuSSnnnnnnnnnnzmEfPWsLb:gISkUxlgmZSKmLs","tlshash":"ef1209797706aa5a0b718f25e04191227d281c2fb37a57d0f48d5ec3b326c407d8adfa","first_seen":"2023-11-18T23:23:23Z","last_seen":"2026-08-15T23:16:20.920261Z","times_seen":1623,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":40,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes-format.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /cryptojs-aes-format.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=oa8wvQmp6UYCboWK; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca2-5d6\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1494,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"e6bc38f77922eaa6f1b23716034b4a2e","sha1":"db781b1e30c4f2a1d63d47054f0903c463cf01ab","sha256":"9ca00bddae85e30d59672da0089ea5e132df97d75a92f42114fe1befbaeaf32d","sha512":"0ad7c00c1564d77f8463dfc81003c0d6cd6ada4e3d01094331f72847f17718e4a6b2c7a2a0bcbd96a1107bc6cb9bcb1721e7b2968ae4544595ab98d39bb30c82","ssdeep":"","tlshash":"163177407debb4c287e8e1d50435a044f67b7a0ab1558ef3aa5aa404ffedf3006326e4","first_seen":"2023-03-07T18:27:54Z","last_seen":"2026-08-07T16:57:51.090464Z","times_seen":717,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Cn9yliqE.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Cn9yliqE.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=4zkDfdwTeYLj7bqd; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-6d137\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\ncontent-length: 112586\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":446775,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"19d5b85492f4d8505bb0d3df174e9e2e","sha1":"84b6548697aa030be332309225e873884d9f3dba","sha256":"79ce7f24d8f2fe12521d0d2ab3e1f77deec6ed8d84313c24f6b0e471532776a6","sha512":"0be04f2ec94f2b25a681d6dd3e61486c30aabe678dd82d01a56bd4a6d9fa45faae911209c277356941b283d09658258d66ebd35497c800c064db73ea06177e1c","ssdeep":"1536:kzGEyMiW9myjPH+UTrFuRSmicJ9HZBynmI0+iAFBynmI0+iA5zAGg1JxBynmI0+3:ktHPH+HFQttb40vzx8","tlshash":"6794b9e1f3a8a1ece017e7fcce26a471351a35fb3b91c5c44294ae749e221ac9d5dc81","first_seen":"2025-10-04T05:11:03.35039Z","last_seen":"2025-10-07T18:16:30.139568Z","times_seen":8,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":15,"dns":0,"connect":0,"send":0,"wait":22,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes.min.js?v=1","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /cryptojs-aes.min.js?v=1 HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=a2sVnhKeq3FlTJxS; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=QSlKlTu6A0J1WDq7; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca2-359a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 4923\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":13722,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (629)","md5":"cd93b7f0987a614bc17698503bcb6af9","sha1":"68a66448326499ff34c75bf31e2769b278584e0c","sha256":"8d4fae1a37a5b5338c889d0897b50024194b4d3ae94940e7e42c1c1423a1183e","sha512":"e3b87dfe10c0e3f3d801a85ae9c654a74eac22c2a93a757568a0d2b13755c36aeb5f9337e94a21db4ef2d1f0f1cfb98fccbbb0151d5cdf8d967730df96bfde98","ssdeep":"192:9BIGDmDm90mP9z8Ui015lN1I5rI2Tru6hMJFmHV+mdpwIfyAaYfKnNVYkUUFJZm3:9yiB0ez8UiIX1SrTegsEHJuI+y8Z7AX","tlshash":"625297c936edb94263963028587f6017b86b28b6945c4824f29cd4ddff9899dc03ae3c","first_seen":"2024-11-30T18:08:34.076577Z","last_seen":"2026-06-26T20:23:29.818692Z","times_seen":1206,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C7dbclZ-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/C7dbclZ-.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=tLZR5sEzfZAIpnu7; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-457\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 491\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1111,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (1110)","md5":"95814635ccf28c50f7025b84ae665292","sha1":"8e7e49c92a940b1a223f5edffc0141d2eae81daf","sha256":"9a5cd10c23cdcfccc8d47bb126a9dad6ea543a55ac206a7126e60d4d69842962","sha512":"63952aaedcd202a8fe7a84815bbd88419337298120c012e558f936441376d532b8dd5c8cf97defe4c1afd5673bc89c62df73e4443c57f573c8e74a95d703070e","ssdeep":"","tlshash":"9021357d4aec2dcc491cbc842ad89d6c7504d249a191cc9638a6fee7f487d5aec48471","first_seen":"2025-10-04T05:11:03.592519Z","last_seen":"2025-10-07T18:16:30.123656Z","times_seen":8,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/tPdbiW_V.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/tPdbiW_V.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=3M8ysaZTZRPIYh4y; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=GpH6vHz6uYno92RG; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-c0\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 121\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":192,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"af7805d42f0e94d87c24a603905aa544","sha1":"7b8e20de9b8033988fd4fb49ae5214be2a1b317e","sha256":"67962a43b72e5541bff19a54203273e73fa6a40aef2c34b20da51c95817d336f","sha512":"4f5b71fae1dbed1ca64d3290836d4ee5f28885ca526c71eaccbad91c58ee45a25d2a2e847846f68d8e02509d5c833f84c2e7a9928991b0418953cbe3dc954732","ssdeep":"","tlshash":"07c01285d8202077cc607828a1d20f42027e3644e115d17c77fc2482f470565a4aec65","first_seen":"2024-05-07T05:56:57Z","last_seen":"2026-01-21T08:18:56.877435Z","times_seen":55,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/logo.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/logo.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=snQoi2E9W6vBIk76; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-5f5\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1525,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"90c2e8c0d206d5eaeac1b5660a865926","sha1":"fe0386bf75d653fbacf2638c0dfe63544acc878b","sha256":"68da6ba7e3c1d4c39c888f4cfef2e3090ae95b091ef2b0bc1e6b638a3f2e523d","sha512":"1912a93b523c285d3ea1da9831b45240b5a6e5ddaacb2922b9b35c346beca192b37ce9881b7120fd215d1ff7087b732df496026f5bb49ae424ea1c27a0433545","ssdeep":"","tlshash":"c0315ee2b3a9d38191080f00834e7864032f15e9a710818ddbd76ba579b526fcc3d8d0","first_seen":"2024-12-10T17:19:34.101377Z","last_seen":"2026-05-26T01:50:54.168263Z","times_seen":69,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/4rtQVv8W.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/4rtQVv8W.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=lLQfoZdG2iUDpDjG; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-103\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 195\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":259,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text","md5":"fee98e2133557b5174d80c41eb5ebc14","sha1":"bed9b980ec37764ad8100634005e005bc18a0798","sha256":"a69a8cdcdd23f4eccbff43ca93c4524fa6285410da77b6d14b7177e900a25ba1","sha512":"410b0aae21ddb19ae205427032d36117ac8053b36f1bc355b00b316ad1db1710e1b556d9b4c1a66c0f7f8f60031588d62ce11338615f75ac0872fb28c1d52165","ssdeep":"","tlshash":"77d02b5d503290741176055908db0d06d147a4b9332552246562aa752698592464ae06","first_seen":"2025-10-04T05:11:03.22978Z","last_seen":"2025-10-07T18:16:30.111211Z","times_seen":8,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":16,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DzVxT-JT.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DzVxT-JT.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=2AJMyhaxhg5adILT; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-8e6b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 9896\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36459,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (26664)","md5":"56b248e4197f0aa4ff0bf9e1a5b45b46","sha1":"fd106eaaf3c02a1a9fd4885d893bd1970db2897e","sha256":"636935d6e62f931bc653ce0b948508d6b13dd6967c2b278ebc0cf8e81016773b","sha512":"cba0682b45dea2fdd1828dbc2d87bc1caa950b6f1a3837281662cf896660c76c8c5560bd9f60302bf997691a60509971c61b5cdf8d7d307ee589da79f2fd3133","ssdeep":"768:4qTY+itM+orCjJJy1ee3JP6r1KCcKlyUW7YC6u64tH/9:jbiJou3CP6YhcW","tlshash":"a6f21a487be0bc34c29a30d7353e09057b726641586f6600e009c6b97fa968a71bef7e","first_seen":"2025-10-04T05:11:03.531109Z","last_seen":"2025-10-07T18:16:30.074352Z","times_seen":8,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Cn9yliqE.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Cn9yliqE.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=yohVisqaaBwKKZ4q; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=RPoBSBU6QtCOn3xv; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-6d137\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\ncontent-length: 112586\r\nddg-cache-status: HIT,HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":446775,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"19d5b85492f4d8505bb0d3df174e9e2e","sha1":"84b6548697aa030be332309225e873884d9f3dba","sha256":"79ce7f24d8f2fe12521d0d2ab3e1f77deec6ed8d84313c24f6b0e471532776a6","sha512":"0be04f2ec94f2b25a681d6dd3e61486c30aabe678dd82d01a56bd4a6d9fa45faae911209c277356941b283d09658258d66ebd35497c800c064db73ea06177e1c","ssdeep":"1536:kzGEyMiW9myjPH+UTrFuRSmicJ9HZBynmI0+iAFBynmI0+iA5zAGg1JxBynmI0+3:ktHPH+HFQttb40vzx8","tlshash":"6794b9e1f3a8a1ece017e7fcce26a471351a35fb3b91c5c44294ae749e221ac9d5dc81","first_seen":"2025-10-04T05:11:03.35039Z","last_seen":"2025-10-07T18:16:30.139568Z","times_seen":8,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/fp2.min.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /js/fp2.min.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=a2sVnhKeq3FlTJxS; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=n2aN5f05Oaj4njYt; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca2-883d\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 11269\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":34877,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (34698)","md5":"02087a3f4f46b15bc198570d800bff41","sha1":"e59f5e3521d8c60e5772de1f65c90e5b87d9eb9e","sha256":"e753042decd90a96d0636a7df16df556860af92ca09ac37f0f6ab1d574acd1f1","sha512":"2c733c348e26c0b400befd5ccac6734eb06a0ca0c8c638f8d3a66afd75ea5860c6cfd3a913ba6dd6824bd9c629c2f28d14204efa625b10fa8fd9b366ba82c968","ssdeep":"768:J2N6EbuZaWRhGT8e20R5J++t6cOrVrzib:oxuZaWRhGoF0R5UVra","tlshash":"e6f21b96b2e8373c8143b063394bec15fb799495e784808a5e2d4180f8758e9e77bdf8","first_seen":"2023-07-23T18:22:17Z","last_seen":"2026-06-26T20:23:29.90284Z","times_seen":1217,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/recaptcha/releases/Jv8jlA-BQE5JD6rA-h_iqNH2/recaptcha__en.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:36:13 GMT","end":"Mon, 08 Dec 2025 08:36:12 GMT"},"fingerprint":{"sha1":"F3:C7:68:20:2E:52:7F:61:4B:43:46:72:CB:A9:29:91:40:A0:5A:96","sha256":"1A:0B:E2:45:70:7A:DB:88:E8:4C:4E:DF:ED:F5:08:2F:2B:2A:CA:33:09:72:DC:80:8B:D2:7B:C6:48:3D:CA:D1"}}},"request":{"raw":"GET /recaptcha/releases/Jv8jlA-BQE5JD6rA-h_iqNH2/recaptcha__en.js HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"recaptcha-scs\"\r\nreport-to: {\"group\":\"recaptcha-scs\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/recaptcha-scs\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 349597\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 07 Oct 2025 00:50:41 GMT\r\nexpires: Wed, 07 Oct 2026 00:50:41 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 29 Sep 2025 12:04:53 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nage: 15787\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":820265,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (611)","md5":"79d46b9e2a42785f28f64082a61eabbf","sha1":"c1b66a198b40bcd1f6cce34704173f997ecd8608","sha256":"6159c42218db471f012088abd52e60fe39e5c1dcf2981ff7d80f38d8bd36a690","sha512":"820943d8b4d684933ce756b9d59c499147aae8336a811b042d8ee8bf035ecb20be12ff815d0ba4a8676c815b9e6bf2d687591d434bedfbbf07e56dae34f39c49","ssdeep":"12288:iF/YdSVcst0yzYy0Vqqog/cT6eKb54lptHAgR1BoOdy3aWKi:QQozYJog/Y6fV4lbpR1BRdyKK","tlshash":"b70529c870257a624332b5f6707b209da36e5966d45c095d70a6c4f03fb098db0baebf","first_seen":"2025-10-01T09:12:21.067891Z","last_seen":"2026-06-02T23:59:04.965062Z","times_seen":7915,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ls-cdn.amplitude/plugin-session-replay-browser-1.4.0-min.js.gz","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ls-cdn.amplitude/plugin-session-replay-browser-1.4.0-min.js.gz HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=a2sVnhKeq3FlTJxS; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=g3SaEZHtMhY2EbyH; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 07 Jun 2024 21:58:38 GMT\r\netag: W/\"ead49d69bc7839b0b873b096d418e1ea\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nx-amz-version-id: a9eB74QCYmN.zM7i5ckvNX3RYMk8LisI\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nx-cache: Miss from cloudfront\r\nx-amz-cf-pop: AMS58-P6\r\nx-amz-cf-id: kpHJdHONpXFqjh2ABC8diCIS8uVe8fhZT63NVun-qEc5mrHM5Uh2_g==\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 36763\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":126923,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c19b1b5d91c8d683b1310562d9c4a225","sha1":"4d45dcac5c6a88e10052f4e356b2170c20413441","sha256":"bb5779145f1ebdcdee053876a4ed060174dda4656978972304c79ddd5f36dac4","sha512":"3a4e8d2e8f5d9a3b45c08ce99374c149a5b67d04d016edfe6259dfbbba948a049301c0cfa5f9bf334cb93b9b4a3558cffa725c166a943c90834c8d2237a1a21c","ssdeep":"1536:Ask/3qTBpVX0Ib6vhb2pJkuppl5METErM2jnpkDtoT1JaM18PIQunrr9gltn2BE/:IqBfX046vhb2pKMQt1Jawi697w","tlshash":"4ec329deb397b033539355a980bb0101b73a6a19300d4464f62ad9ea3c7d847a277fbd","first_seen":"2025-08-09T06:39:58.991299Z","last_seen":"2026-03-24T13:49:06.781634Z","times_seen":48,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/jXgXeeQE.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/jXgXeeQE.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/CkMSVCQx.js\r\nCookie: __ddg8_=NpQnmSkRWdbOXQAW; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=EgrGzrV0WGrNDA7u; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-351fe\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 41636\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":217598,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (37705)","md5":"f84804da82d9c4cb7ddd9e71f0ca1f6b","sha1":"64c4e19b9eb6ea410c08dd63881ddd0cb318255d","sha256":"2c0d1951397683fbd5db45458698ddee96bc097d1c27017de3493bd092d4b841","sha512":"87c74f73697be0716dfc5d1a33ef2f121591b1c214a1e4e2ad5c778f0817a36c52fe0bbd776c8abbe36532eb8182a1be5d688e4a9103748744a2718d4b51e618","ssdeep":"6144:cCuayegAufVcvTgOg1msMr0Ouyfo8x326pl5OaPydoMbUCzxNeuGgSBm5uz:cCuayegAufVcvTgOg1msMr0Ouyfo8x3p","tlshash":"bf247e320e5d1cbd1111a166de1cab1a38de81fe3e9b93e107796e6e35f10309ea931d","first_seen":"2025-10-04T05:11:03.708279Z","last_seen":"2025-10-07T18:16:30.087249Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/footer/lvlx/logo.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/footer/lvlx/logo.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=wmzm2nuY2gsunNFP; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-4a0\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1184,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"743489fa6132c79707cf67ab559d050c","sha1":"b1f7c69289033703f975043997715530210cc716","sha256":"bf3f8d2962026699f0229ca007322db9edd9ed366fe6770ef79c46276aeba886","sha512":"578e579d2a9806e1a6331644d4980185e0867dac3dd19136132e0fef3ef0b5ee8893889fbf922f7c8a40f089b4c19d4a0649567673dac7bd85c0203f21ffde6b","ssdeep":"","tlshash":"ed21078031995381640b47d4fe2b20345d57a0f7efcdf1fc16e14aa3a4d125658e4ed0","first_seen":"2025-08-09T06:39:59.124894Z","last_seen":"2026-04-15T02:03:05.831565Z","times_seen":46,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Icons.DcXG4f08.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Icons.DcXG4f08.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PRWAqMjBJvrAhwnS; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=PQAsCnlbge8rbH8H; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-2ce\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 166\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":718,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (717)","md5":"676827eb558cf063ae766720cb4d5f3c","sha1":"6c2d0a4e8ef98fbc7a74a7c1dae9b16408fa75c2","sha256":"06c154b48333f56cbf15f9e7226c90ee7488ec9c4f56bbbbdadad36e0e8fab0e","sha512":"b31196631bd64a9347fd27239a4cab44535052ecabf0141d3809589851776990589ad8c9aba10c548da7ba7bb441c89e381bedb92dd81e56999311591c6916c7","ssdeep":"","tlshash":"ef01df7db65ef94b533bca0ee24c002311ea77a7dd418180228bb836b97a760381f073","first_seen":"2025-10-04T05:11:03.520159Z","last_seen":"2025-10-07T18:16:30.102849Z","times_seen":8,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-07T05:13:47.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=de81zTZT0lkdDIPF; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=a2sVnhKeq3FlTJxS; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: text/html;charset=utf-8\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-powered-by: Nuxt\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":404308,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65063)","md5":"af61bfa2478e85735e038c390c5730e8","sha1":"ce778c40054d98cd39c5d5c55c3a4ae76034b6e5","sha256":"ae002d460bbfd92fafbc2c039fdc4e60e4dd88394d5ab56f1de3bfc1c1901fa5","sha512":"f9f1a3b11ec08fc56d1429518a44a6da6833249e657fc7693b08e411cb4d516c68b0f2dfcba01211071a36b93c083c3acd56376ef0559c391f16962b0b1f8865","ssdeep":"3072:7JYXSbqAfuybg1s705YOwfwONtsEb2F61UbFhT:HbqAfB705YOwo4tsEb2Fh3","tlshash":"a184d5d36630342ea16fd457f1a1eed8f434a815d31367ebf1e61a25cbc2c861663a38","first_seen":"2025-10-07T05:14:26.681553Z","last_seen":"2025-10-07T05:14:26.681553Z","times_seen":1,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CFzQcB0L.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CFzQcB0L.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=koA1gitCrSBhLgs3; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-39e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 331\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":926,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (925)","md5":"e03518ae3241e6dd395a063ba226f056","sha1":"ce8d73c397d5dc7ee93d3f441458d108201216c3","sha256":"5d716e4a24b41b70d9761f4ae2cc82b40a9e511e6cc6b8928bf37c1d61fc6ef6","sha512":"3de9e95ab046329789ed32f1404e4461988c1ce6bc41d1740d7c73cf1a87f4b802920111f593f14038981c80deb5d91190e6de0ba5f867f5b2a7d6b1062d6c60","ssdeep":"","tlshash":"3b11344e90351e9dd06ccfba806af38330609dbb2713e0597919d1a43eda4034d28f32","first_seen":"2025-10-04T05:11:03.43181Z","last_seen":"2025-10-07T18:16:30.089715Z","times_seen":8,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/vip/mainPage/star.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/vip/mainPage/star.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=jQ2CSoQMok09k0pa; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-c33\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3123,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3a52a0c3104e4ce6b3892f0cb079d27e","sha1":"9315a6cd602fb8d2477a0723f587307a43677cad","sha256":"49e08c929ab24a51bdc8935d0b1c7d8841abe3025755cc735640f3e10d218f87","sha512":"2db493ccaa35d93a4f7220c3c520057b9fea5d5cf79c7dd8faaa22e74e8b2ae3c7f839fcc3096a7c1c0d23e91fccbd800d98b2d679888a04972d7746ee368fcd","ssdeep":"","tlshash":"bc515af639ada9dd9c879264d3a95c900f3de1b4f11084699d8f0a31c09bcc6f5672c8","first_seen":"2025-08-09T06:39:58.898385Z","last_seen":"2026-03-01T21:47:53.493327Z","times_seen":39,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/default.0Z-hrgpm.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/default.0Z-hrgpm.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PRWAqMjBJvrAhwnS; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=n4b54fN9MRq1laoF; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-b495\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 7659\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46229,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (46228)","md5":"87f35b3ae9a4a2498c3d3e43fefa4d55","sha1":"05b23a7b14fc1e1e5a0ff9038a182a3f671d0723","sha256":"447918c8ea5df2d6d6a956b41bff24ce4b3caa7e5a1fab8d1acc20bba7d7b3d9","sha512":"1bc2892e95efe283b77173a9bdd47e9de3e26fcc00ff14d405ba9e85a6575f19698c8ec0499600291d4a2d91a4896906a795aef37b2c67f7d4930215070b4634","ssdeep":"384:G0jQN6Dc0cWJ7Hv0Dyikxb4v0DyiSft3JnymteZFcy/xqFnMRfv6rfD:LrtHvkQGvkU6PDwSM","tlshash":"90236621771c607cb53bc9a2b490169e2039f707d5239faeed693629c9c71d32b627c8","first_seen":"2025-10-04T05:11:03.495513Z","last_seen":"2025-10-07T18:16:30.109244Z","times_seen":8,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DXFcmPY7.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DXFcmPY7.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=3M8ysaZTZRPIYh4y; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=ZhEWYdf9VxojHhNi; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-23dc\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 3839\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":9180,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (9179)","md5":"f35775ff648ec6716f2a297601310e96","sha1":"7305e85cbb919d8b85f3a5930e3f296b5e6fa785","sha256":"4511ce05d79359267133ee9e7e89fe59be13436a70679dacdf294e07de1bdc6d","sha512":"c81450c578ff1a8ef035a1d56429dd637b3533bde838720faf99a48ee0d1805b8f24567ecb757ca921606067907d517d04226b17383e91d3a37c4fce563a34f5","ssdeep":"192:XqsxSEFu6ZufGq++k5q2IkZQ+tOWwYpsTctY0ipgNE7oVKRpnKFEN:XhZ8fK+kQ2IkDLwYpfYZplOKRpnv","tlshash":"c212e9e473ac72aa59630dd12475481de434e6243b26f4d1f2ba38bab497c44b273f2d","first_seen":"2025-10-04T05:11:03.241006Z","last_seen":"2025-10-07T18:16:30.134044Z","times_seen":8,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-07T05:13:44.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=PYvSqXr0cbZ1mIUz; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:44 GMT\n__ddg10_=1759814024; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:44 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:44 GMT\n__ddg1_=RyFytlPEjbdkx9tyBP6H; Domain=.gwdt26x.life; HttpOnly; Path=/; Expires=Wed, 07-Oct-2026 05:13:44 GMT\ni18n_redirected=en; Path=/; Expires=Wed, 07 Oct 2026 05:13:44 GMT; SameSite=Lax\nuserVersion=45.10.240.51; Max-Age=86400; Path=/\nuserBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; Max-Age=86400; Path=/\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: text/html;charset=utf-8\r\nvary: Accept-Encoding, Accept-Encoding\r\nx-powered-by: Nuxt\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}],"data":{"size":404308,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65063)","md5":"af61bfa2478e85735e038c390c5730e8","sha1":"ce778c40054d98cd39c5d5c55c3a4ae76034b6e5","sha256":"ae002d460bbfd92fafbc2c039fdc4e60e4dd88394d5ab56f1de3bfc1c1901fa5","sha512":"f9f1a3b11ec08fc56d1429518a44a6da6833249e657fc7693b08e411cb4d516c68b0f2dfcba01211071a36b93c083c3acd56376ef0559c391f16962b0b1f8865","ssdeep":"3072:7JYXSbqAfuybg1s705YOwfwONtsEb2F61UbFhT:HbqAfB705YOwo4tsEb2Fh3","tlshash":"a184d5d36630342ea16fd457f1a1eed8f434a815d31367ebf1e61a25cbc2c861663a38","first_seen":"2025-10-07T05:14:26.681553Z","last_seen":"2025-10-07T05:14:26.681553Z","times_seen":1,"resource_available":false,"data":null}},"time_used":515,"timings":{"blocked":143,"dns":0,"connect":22,"send":0,"wait":229,"receive":0,"ssl":119},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CIV1DmJm.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CIV1DmJm.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=OC9qEYkjJZ5TSmkg; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-36a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 438\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":874,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (873)","md5":"3bcb3cb731faa08f8e975f22576abf93","sha1":"05344c9790022a0d796fe682cfba3af36a0347db","sha256":"ee27ce8fd95c8b0501fb72850528edd31a3d0195819a462635ca117c897cc60f","sha512":"73d6c16f46985d8259360bab931cb67e77640c8585a6ef8df1950979b4eae173ae318c351dbd07548a5d6d4b28d596f35c41db8840566f386f52f61fd70fce23","ssdeep":"","tlshash":"0c118cc070a4a431c3b849c801d5abb2b55d96843de782d4e45e1d33213f89cc579b19","first_seen":"2025-10-04T05:11:03.497488Z","last_seen":"2025-10-07T18:16:30.088926Z","times_seen":8,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/inAppPlugin.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.304Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ext/cdp-customer//v1/analytics-js/inAppPlugin.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=1XDFuYGq1TUZhJcx; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=16kRo0OZB6GnzM7l; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: text/javascript\r\naccess-control-allow-headers: Authorization,Content-Type\r\naccess-control-allow-methods: \r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\netag: W/43bc44026ca2117bf0438e53bb1919b7\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: public,max-age=300,immutable, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nservice-worker-allowed: off\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":5580,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (5580), with no line terminators","md5":"2b3f92234d8907a103ec9dc2b05589f1","sha1":"2f2c0961bace40551cc39d1728715b94ec82db2e","sha256":"ae91906abf85a449f6ec41c31f1bc77b9bd3505bb7e55d61760b47c3fb11e3dd","sha512":"62174308a9634879afda50af1511adf6af4081ae78910db5c71cc0bb764cfb2c287c659d8653268b4b1eba7e6eb76b7b8096c1416a28b069f19e38019a7d38a2","ssdeep":"96:frYe+t6Sgb0qKEIwRGBMtIPmcKhgbUk6HEHvRrVxEC7NTjQCtGf8J4HJDFqK/+bD:Nd7KOwBMtgLgHE7T864KKqKk","tlshash":"3cb1ec9df793f82c05f39a7de5773423923a3b026099e411e057cec2596838d6123bb9","first_seen":"2025-09-25T08:21:12.736151Z","last_seen":"2025-12-15T01:19:11.275667Z","times_seen":356,"resource_available":true,"data":null}},"time_used":310,"timings":{"blocked":176,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/ajs-destination.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ext/cdp-customer//v1/analytics-js/ajs-destination.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=DoBJk4rNaEi8bHxp; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: text/javascript\r\naccess-control-allow-headers: Authorization,Content-Type\r\naccess-control-allow-methods: \r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\netag: W/70a1cd6d5c300a59c3b828b336627efe\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: public,max-age=300,immutable, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nservice-worker-allowed: off\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":9226,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (9226), with no line terminators","md5":"ecdb24cdd6b5a3a4a7ba31895f79ca4b","sha1":"3284a1f3ba7aa68b324499a64bf32c8101701663","sha256":"ef949bb08ab368c25ce835e54a53b3eb842de7e868ff81ff99520ed16394637d","sha512":"e76cf7a6f407f484c5537258129ee7d29b765a14204c0cd4e1ee9ca3d9542ac01c5c0b0c557e704d8c69a1a12b29312b99ec0fd25608af07b3c79ea5a83d0492","ssdeep":"192:d61F3JpeOVXIhCBnMfJlUEpFX8nmuONy+2Yn:doF9TMsEzZuF+2Yn","tlshash":"5f1212ccf6c7f0055267bab5817b451ab33ebd1a244a4894f42bcdd5287c619a12bf38","first_seen":"2025-06-01T15:05:10.790294Z","last_seen":"2025-12-16T16:58:04.809767Z","times_seen":521,"resource_available":true,"data":null}},"time_used":129,"timings":{"blocked":19,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/roboto-medium.eJsCudPf.woff","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/roboto-medium.eJsCudPf.woff HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=mH9i5UabqOCoQxLI; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 140892\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: \"68df7ca1-2265c\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":140892,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 140892, version 1.0","md5":"cf745939a2f0d88aa9e9e111d03f0c44","sha1":"e3e7869aa64560578586af40a475c0dfa55b8b77","sha256":"7090bfaf91390512f722b859fae9585ec5f662e31fbc00a0a281859f92c54c4e","sha512":"ff2483368f008496135c596a8b2863a9c5953a52041c85e03d3c01e6d4cb16ee74efb5411da034b9606b1a23e2d77ae472c9bfdc0b5358440d96c2a9a22232cf","ssdeep":"3072:tyGRtev6xczb/azWnXkjS3k0wzb9QZyKqtU0EzCq5YLA6+Txvw545N:FGiGzb/LnUwwzZUWN+B","tlshash":"4bd312b5d6a53397eef8fdca71a80f62279dbc48e8ec8f0b251c48543507ca9c276520","first_seen":"2023-04-14T07:00:11Z","last_seen":"2026-04-25T06:32:47.456343Z","times_seen":66,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":79,"dns":0,"connect":0,"send":0,"wait":86,"receive":153,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/logo.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/logo.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=n5SWjJclNVMkDATL; __ddg10_=1759814026; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=zKFDQPHOmKhkr5bV; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-5f5\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 728\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1525,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"90c2e8c0d206d5eaeac1b5660a865926","sha1":"fe0386bf75d653fbacf2638c0dfe63544acc878b","sha256":"68da6ba7e3c1d4c39c888f4cfef2e3090ae95b091ef2b0bc1e6b638a3f2e523d","sha512":"1912a93b523c285d3ea1da9831b45240b5a6e5ddaacb2922b9b35c346beca192b37ce9881b7120fd215d1ff7087b732df496026f5bb49ae424ea1c27a0433545","ssdeep":"","tlshash":"c0315ee2b3a9d38191080f00834e7864032f15e9a710818ddbd76ba579b526fcc3d8d0","first_seen":"2024-12-10T17:19:34.101377Z","last_seen":"2026-05-26T01:50:54.168263Z","times_seen":69,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/vue-splide.C9Z0wB1j.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.648Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/vue-splide.C9Z0wB1j.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=zKFDQPHOmKhkr5bV; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=dZrAF4PlVC8Fc9JA; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-734\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 676\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1844,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1843)","md5":"e638a23113de5c173bd45cf1ec17cedd","sha1":"5e71875f9d7d6d3240729a9300e2be7b2c49d0d2","sha256":"25fecdb4c8330c6bfab65a09dbb53c0d8f407344f2ba4f4438bb48293444c846","sha512":"c76d640e7077019c6c609684d476a47b812c67eb4fbc8cf85240d2bc6e96e5254434483c8c8046b15b3683e09c749b26055b48f9656e0dbf5d78bad8aa18872c","ssdeep":"","tlshash":"fd31442240c92f599843973229bdd7a964eec2534e6302baeaded320468ad4d07e49cd","first_seen":"2024-08-20T04:44:02.347145Z","last_seen":"2026-07-20T07:08:57.528836Z","times_seen":137,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer//v1/analytics-js/646.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ext/cdp-customer//v1/analytics-js/646.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=jQ2CSoQMok09k0pa; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=AWEyf8ejeKyNroUA; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: text/javascript\r\naccess-control-allow-headers: Authorization,Content-Type\r\naccess-control-allow-methods: \r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\netag: W/57a98141b93ad7f0310e6134ab19ac9e\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: public,max-age=300,immutable, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nservice-worker-allowed: off\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":26551,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (26551), with no line terminators","md5":"c83e6df6ffa3af6337495fadc058adf3","sha1":"1bb413dd66d4e85907de4414bb98fd17be6ae482","sha256":"d128bb0eda8faaee8ff9b04a261ad0e835dfe1631768aa39c1a54952261d5787","sha512":"7ed7358de7f6d30a0c529a75c1fe9b1e6e79b34f8753538873c0c517dd28c52e423abeb772c0be518d344f2f513f3ff1c7b5b511aa99645b7596f4edb7771749","ssdeep":"768:i4V72U1y21F6WiEyKS3K/70fjjtRBlWBqnNyV18u8/zo8NyB5CJ:i41yGviEy+0vtnNyV18u8/zMO","tlshash":"bbc2f94a316a393d83d351e7bd7a3006633b7555b849c041b2ade8872f294cf6273f9a","first_seen":"2025-09-25T08:21:12.740421Z","last_seen":"2025-11-07T14:36:24.349236Z","times_seen":171,"resource_available":true,"data":null}},"time_used":273,"timings":{"blocked":162,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C72coOWc.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:46.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/C72coOWc.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/CkMSVCQx.js\r\nCookie: __ddg8_=PubFxzLXt8Hdezzc; __ddg10_=1759814026; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=Ih0wFmAe1nUWOxeL; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg10_=1759814026; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-56e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1390,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1389)","md5":"f3bc6cd8453440a2112d76ab82bf7bfd","sha1":"af19e1d374dc436237a39c274cc7162326a03096","sha256":"d2f31fedab9f60c9f48cc734c847add5835557c2d4aacbccc3d1ed8794562a8f","sha512":"7f68ed63cfcda6c55de267e2e26029838317ccf504652ff4c2659492711864100aa52eb5722688d7d6a65efef4897edf1bb6a1d9c8e4cbdf225971f1b8ac00f4","ssdeep":"","tlshash":"ec21fe4fd000d03941aa8df8e069a92163b352ef03e9d6b5d2ee0e750b80025c14db1b","first_seen":"2025-10-04T05:11:03.629959Z","last_seen":"2025-10-07T18:16:30.085382Z","times_seen":8,"resource_available":true,"data":null}},"time_used":85,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/js/button.js","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /js/button.js HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: application/x-javascript; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nExpires: Tue, 07 Oct 2025 06:13:48 GMT\r\nCache-Control: max-age=3600\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":899155,"size_decoded":0,"mime_type":"application/x-javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1210)","md5":"587e13c24d17141fecff62e86a00ffc4","sha1":"b67c345ddb508d91f6aeb774a086db22cef92530","sha256":"b18d676e74a1991942986057293a33b529fe3b5bad23ba68c06667d67a1d225a","sha512":"8c61210e82be9f7e0581456056d8592a8c4f15cd5a361e5c37f57308d367406b80487b99a2c26a4530eb777f8ba43f7a5ea584d7bfdbaf710527871be5ececec","ssdeep":"24576:/o36wXnnOqCNTKi983ht1x2vRfXjXjryWsz9tQ:/o36wXnnOqCNTKe83ht1xYdTjryWshtQ","tlshash":"e2155c897644353a82dba2bf702b170976379552a444d46cf878e8d4bfb4d09823bfbc","first_seen":"2025-09-20T02:53:52.592022Z","last_seen":"2026-01-19T12:14:51.147852Z","times_seen":173,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":68,"receive":82,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/button.php","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /button.php HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:45 GMT\r\nContent-Type: image/gif\r\nContent-Length: 43\r\nConnection: keep-alive\r\nX-Webim-Version: 10.7.130\r\nEtag: \"2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a\"\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"325472601571f31e1bf00674c368d335","sha1":"2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a","sha256":"b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b","sha512":"717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc","ssdeep":"","tlshash":"bf900003ea80c002c2a2c0300e0ccb802b88b0308a28030fb0fc3baeec3a3a20c23000","first_seen":"2023-04-05T06:29:39Z","last_seen":"2026-08-17T14:16:46.17756Z","times_seen":96971,"resource_available":true,"data":null}},"time_used":395,"timings":{"blocked":176,"dns":50,"connect":41,"send":0,"wait":41,"receive":0,"ssl":86},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/builds/meta/792665cc-f47f-4a2e-b850-f38f6638ee95.json","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/builds/meta/792665cc-f47f-4a2e-b850-f38f6638ee95.json HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=fTJ4DMruRLcVAJr0; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=YMv5s4HimNEisZbG; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: application/json\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-8b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":139,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c6d306a66f8ad6f6b13984e052ba324e","sha1":"2ce342871fd6cd25aa075cbeaefa49959fe9da18","sha256":"9640f306d4ff07ed13fa06f8fa06308fe72a35e667ae6193b955799177f748a4","sha512":"afa16558e0a1d03949a2990452947660f5f905e967df6d4b4c2d0c9957732d431df0d491a2db16f6bc1726e878977a947036eb6ff67e98bdae48cbcf48f750fc","ssdeep":"","tlshash":"84c02b32041480937d720953d40c3c74c1f64322893c2c74e3540f3d035c2cf2014017","first_seen":"2025-10-04T05:11:03.27339Z","last_seen":"2025-10-07T18:16:30.079315Z","times_seen":7,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/vip/mainPage/bg.webp","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/vip/mainPage/bg.webp HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/Home.puxSNRNF.css\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=HbS5rtfZD43xcDDu; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/webp\r\ncontent-length: 45556\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-b1f4\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":45556,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e39774d542e18edf4cfa36d04cac809a","sha1":"1861275d48a7be8ed8e03c06490ee02bde83b69a","sha256":"82c6d25a57ecbc14b8e3a4fff7bb25120f682501ed9b6e82a914e83952ab2429","sha512":"5055dc2080e22142fd134adcd8fd334b4c6b5b36e859afbbf49b43a680fec8abb711339dda4c1d44386f0e2b8aefb1ebe7a05df04f030117acbc9836e8c3c771","ssdeep":"768:YwAhH15qKerR/sXK+oRPl955n7wKiV3tfidYKNt6jb5mUbFuQgyTvmWAZwO4vRf:HALUcXEnrxwKkfihD63zMyKWAeO4v1","tlshash":"a313e0c05342605ebf48a97e7fdf0096443a6dc417ba80f299638b157fb3934ba71a78","first_seen":"2025-08-09T06:39:58.842762Z","last_seen":"2026-04-06T22:48:49.739794Z","times_seen":58,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":55,"dns":0,"connect":0,"send":0,"wait":82,"receive":102,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/sounds/click.mp3","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.287Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /sounds/click.mp3 HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=DoBJk4rNaEi8bHxp; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=zD082hTTx2o32VNC; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 6731\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-1a4b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":6731,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"b497ee5b7f24d5540859a2fe9a2f94a8","sha1":"402f32b8a0c59a6655cee008020948c8b0dc3878","sha256":"627e28dd820dbe208a2d764c086b4eca2c54330b9741073bec9da852aa592962","sha512":"1f0e4fd80c187354ac665cf7e3dc52b8834ef35022c6fe922db3aae0f89f8530c5e97aa2d4860f2351c8fbf05ea2252593d626d12b8f90865b7eca6b6a476ee9","ssdeep":"192:79qf6EhSf0IotHNKWliJRgFn0DsEZM8+h/wgMgl:79qf6ASfCtHtliJ2F6sEZMph/w1gl","tlshash":"cad16d6a6d478951e40c5570d8ce1b4c737824b5afb0b3daa267f79e00e536c12ceb29","first_seen":"2023-04-10T18:19:05Z","last_seen":"2026-06-26T20:23:29.963181Z","times_seen":1246,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":88,"dns":0,"connect":0,"send":0,"wait":89,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/C28Ks5WD.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/C28Ks5WD.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/CkMSVCQx.js\r\nCookie: __ddg8_=tySZ2DdjxraAdiMC; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=fziy2llihOp7pTp9; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-34783\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 53775\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":214915,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (62123)","md5":"226f97aae05b1bc8517bf6e8357b2035","sha1":"ec26d9e8486f92c5be054c7bbb23c607efc40016","sha256":"3a540feffb54425661775040e9d000fc91c8541e60a10d28b4916048e20d7c69","sha512":"a3f3fe091a35f13546658cfc513bdb66fc91a4fc90794d5ddfb88b64b6291a59029695134bac483280d8e88206b6497415122e156c68d87abd6a8324435c4057","ssdeep":"1536:7oDsoGxvPYALxa1k9CdeIusU1aCrhquwRpeQIvkn459rS90dBuwRp0r1GcJwdAfH:zZxvPY0L9sMawdAfGvM","tlshash":"03247daee38690fde12b8794a44b381431752ffea681cc8381fc5d0466268fc57ede65","first_seen":"2025-10-04T05:11:03.298502Z","last_seen":"2025-10-07T18:16:30.073415Z","times_seen":8,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"gs.jdwqqi.site/socket.io/?token=\u0026EIO=4\u0026transport=websocket","fqdn":"gs.jdwqqi.site","domain":"jdwqqi.site","tld":"site"},"ip":{"addr":"91.215.43.62","port":443,"asn":57724,"as":"Ddos-guard Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gs.jdwqqi.site","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 Aug 2025 05:41:47 GMT","end":"Fri, 28 Nov 2025 05:41:46 GMT"},"fingerprint":{"sha1":"A0:04:FE:A4:D6:2C:BC:C8:08:C0:C7:1E:53:B1:71:4E:C6:8D:D7:E2","sha256":"FE:C1:18:11:0B:D5:DC:B3:B2:7C:2B:2C:2C:D5:40:F0:B2:74:A7:52:80:A8:D3:B3:88:BA:A2:FC:32:19:BF:42"}}},"request":{"raw":"GET /socket.io/?token=\u0026EIO=4\u0026transport=websocket HTTP/1.1\r\nHost: gs.jdwqqi.site\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://www.gwdt26x.life\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: gfIsomEhCFWhLGQcWIRj9Q==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: ddos-guard\r\nSet-Cookie: __ddg8_=zwGVM6B7cTNFlMxy; Domain=.jdwqqi.site; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.jdwqqi.site; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.jdwqqi.site; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg1_=GW2qHo8drQ4ySOvLrrzX; Domain=.jdwqqi.site; HttpOnly; Path=/; Expires=Wed, 07-Oct-2026 05:13:49 GMT\r\nContent-Security-Policy: upgrade-insecure-requests;\r\nDate: Tue, 07 Oct 2025 05:13:49 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: fenz4zWawYay6MiqWlc0rZpDm80=\r\nSec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover; client_no_context_takeover; server_max_window_bits=10\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":530,"timings":{"blocked":0,"dns":90,"connect":111,"send":0,"wait":270,"receive":0,"ssl":148},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CjIjlGq-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.311Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CjIjlGq-.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=Qkoq0awwpSp4tPq7; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=uzLLjkVPFicb32Z1; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-9ce4\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 12832\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":40164,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"8536f2f542c30c3b37aa68fa9d57f5cb","sha1":"4679e0eb2b374266ccf64bfc73ac98dad5143a1d","sha256":"84a0b743a7ef37e6cd2a2db660b4b5899c3fecce9d1f28502709614fc9d191fa","sha512":"126dd430ac683507fae1c2a1e11c5ff94a9015441798342ca77791fe29709b30c33f8b30ff1b10b1f08b51fac27d016fed4b2f8e724afb82dd8b57c2fbc7fbfd","ssdeep":"768:kC43aMGeQtDCPB/HyzE0qct7yxP2C7dSlSxkPut06BcftOashQWEhQEq/iiB8faZ:760xiywcV64IX","tlshash":"e303f8c8b2a0506583e2a1a390750203f33999153409855cbb2ceefbad7eeda7177f75","first_seen":"2025-08-19T01:32:32.322521Z","last_seen":"2026-04-26T08:04:42.226428Z","times_seen":67,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/v/ui-resources.php?location=default\u0026mode=desktop\u0026lang=ru\u00269ae4a29f\u0026callback=getWebimUIResourcesCallback","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.717Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /v/ui-resources.php?location=default\u0026mode=desktop\u0026lang=ru\u00269ae4a29f\u0026callback=getWebimUIResourcesCallback HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: application/x-javascript; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nX-Cache: HIT\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":625730,"size_decoded":0,"mime_type":"application/x-javascript; charset=utf-8","magic":"exported SGML document, ASCII text, with very long lines (65536), with no line terminators","md5":"11b438f338bd2b9e4671ecd18c16989c","sha1":"438b66fdfd873ff5f47c57bbaacd3ae1b0eeae27","sha256":"226f3be66a9d2f9f6a3bdad6e3e280a292f0d9bf7cce15fc382cb023bad866a3","sha512":"a6fba66b9240a4fec3298822e71776454c9ce66287af73b2839eeb18819b0af53f0076f22afbeba1c7477028333d5b07bcf5fa0d8a7fcf99c3fa355ae50bc800","ssdeep":"1536:QQHOcWqV61g4iy5VkMN2KQRgME234Cs57h7Fbsas1sUs+s1seT5Ggr6uN+Y3L5i4:cMCvyawQJ3gy5f9uZS44WkHD","tlshash":"dfd4270feed21469be2bee6361f70655713d34a29590079cb22f34de5f81ce29322b64","first_seen":"2025-10-04T05:11:03.45314Z","last_seen":"2025-10-09T10:23:07.246583Z","times_seen":7,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":81,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DxTym_EP.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DxTym_EP.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=dNepeey0veb35vFv; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-142c\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 2073\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5164,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5163)","md5":"a86bd43371591230ada5d1456dab8aa0","sha1":"b63e835649ce8bec3af500a596a7a1f58272afb2","sha256":"23ec8c94b2d36cce2ca68ad1e07e75f81b886d3d0077acde44ee2f5981e3ca10","sha512":"c2f22c55f07b8c50d90c20493fc7dc2b4ed68615b8adca2c23cbb0c8439285544b86a623e919ed65f23f8dd6202d553dab85551ce8953e3e9c963b24ff059899","ssdeep":"96:oeyq53hKMoKMj1W3FdeF31f5HnPx1oRstVCBR4Ir8Dtgjiby+qUECPRv5:o83BY1W3eFFvmQVCkIgJbtD","tlshash":"f5b1a7e4b1d9e09bb7b64fd1c032225260076ba57434f0d0f27aad73215be54a562b3f","first_seen":"2025-10-04T05:11:03.300471Z","last_seen":"2025-10-07T18:16:30.054069Z","times_seen":8,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/games/casino/best","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.280Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /games/casino/best HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":19,"send":0,"wait":0,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CkMSVCQx.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CkMSVCQx.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=skkoX6gsNOiwKWZX; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=xRdh1LTnTziiXLkJ; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-75efc\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 166564\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":483068,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (47660)","md5":"79068909446126a70dccef2e4c2a06cf","sha1":"3f1f59ca79626ad920c3f2ce34109d2d06ca1b7f","sha256":"8214d22013513fb9a76d56a5723c9ecbaf725ebb9beff448232c77e30a459faf","sha512":"437b07be547ebde1a4dac1fdcfbdc3521519d219b964b3e1cb959bbf76c98f5165fc8af5ed54a44cb436d8b827326c03020820e0dd888540088fc28351669c12","ssdeep":"6144:EW2i6XYOhfa7HN9OCjhpr9SPXiBfmECS4Teq2YvnqX1SnI7mbvnQGcRjsXKAiH2i:ZXkhS7DO+hprP9mxS4VTqlSnKG6wXKF","tlshash":"6ea45ad97196b02213f619e4807b0106f3392a54384ec4e8f16d9eeb3d7690a92b7f7d","first_seen":"2025-10-04T05:11:03.286196Z","last_seen":"2025-10-07T18:16:30.070847Z","times_seen":8,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/tPdbiW_V.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/tPdbiW_V.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=dIzK8pImJvyNGnyV; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-c0\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 121\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":192,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"af7805d42f0e94d87c24a603905aa544","sha1":"7b8e20de9b8033988fd4fb49ae5214be2a1b317e","sha256":"67962a43b72e5541bff19a54203273e73fa6a40aef2c34b20da51c95817d336f","sha512":"4f5b71fae1dbed1ca64d3290836d4ee5f28885ca526c71eaccbad91c58ee45a25d2a2e847846f68d8e02509d5c833f84c2e7a9928991b0418953cbe3dc954732","ssdeep":"","tlshash":"07c01285d8202077cc607828a1d20f42027e3644e115d17c77fc2482f470565a4aec65","first_seen":"2024-05-07T05:56:57Z","last_seen":"2026-01-21T08:18:56.877435Z","times_seen":55,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer/v1/p","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"POST /ext/cdp-customer/v1/p HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nContent-Type: text/plain\r\nContent-Length: 760\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __ddg8_=16kRo0OZB6GnzM7l; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=PRWAqMjBJvrAhwnS; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: application/json\r\naccess-control-allow-headers: Authorization,Content-Type\r\naccess-control-allow-methods: \r\naccess-control-allow-origin: *\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nservice-worker-allowed: off\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":16,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7363e85fe9edee6f053a4b319588c086","sha1":"a15e2127145548437173fc17f3e980e3f3dee2d0","sha256":"c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97","sha512":"a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85","ssdeep":"","tlshash":"f0600003000000a2c000220002382e202080002280000008800c20088a20000208300a","first_seen":"2023-04-05T04:17:27Z","last_seen":"2026-08-17T14:41:38.734248Z","times_seen":183019,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":128,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/eurostile-regular.i2b9H2-b.woff","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:46.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/eurostile-regular.i2b9H2-b.woff HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=7HPltmSLSzY7vLXp; __ddg10_=1759814025; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=syO7Ts8OxFtF7odh; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg10_=1759814026; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: font/woff\r\ncontent-length: 97680\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: \"68df7ca1-17d90\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":97680,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 97680, version 1.0","md5":"535b1e86232aafcca96b143529c8226d","sha1":"9408a42efc92ea6972f4d0f50560c22ca84d8a08","sha256":"c5a7a7d506426bb073f4f866f0ea9f3c57c8e856444e5403494d9db263e85671","sha512":"b54f1a43cd21271056f02d0626c573357b3ad962969d24a7c03914513d6644155108d5fb0608d47c734e650e1141de70cb9cc13e1ee1f08830c33ecd7dbb8abf","ssdeep":"1536:mndVS5OB0M0Lfxv9JKgzmzwv25WCnEx2pW594UIi/m3KYdu+WLSkNQ:mv3BbuX0gswcIb4UIi/m3K4u+B1","tlshash":"95a312039a03b7246d764afa2eaf4b39f5d4ef988d0d63c147e1a410194d52f2f6126f","first_seen":"2023-04-14T07:00:11Z","last_seen":"2026-04-25T06:32:47.453739Z","times_seen":81,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"us.i.posthog.com/flags/?v=2\u0026config=true","fqdn":"us.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.216.175.216","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B2:07:A5:B7:4A:00:EA:45:09:50:EF:4B:44:63:83:38:E2:97:F8:13","sha256":"6D:1D:1C:48:82:61:EB:EF:E4:D8:57:9A:EA:F6:ED:0A:07:BB:6C:17:71:6F:A3:F1:88:57:DC:E3:A4:E8:44:96"}}},"request":{"raw":"OPTIONS /flags/?v=2\u0026config=true HTTP/1.1\r\nHost: us.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://www.gwdt26x.life/\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: https://www.gwdt26x.life\r\naccess-control-allow-credentials: true\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-methods: GET,POST,OPTIONS,HEAD\r\naccess-control-allow-headers: content-type\r\nx-envoy-upstream-service-time: 0\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":92,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BgUJLoS-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/BgUJLoS-.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=LgvvEPndjOZJLMJj; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-adf\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 1004\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2783,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, Unicode text, UTF-8 text, with very long lines (2716)","md5":"3d2c02d74f4c0768d16385c23713a8c0","sha1":"1e2f8b6a1650552df13bd17f73f349846209ee3c","sha256":"8512dcb0a79df73db990833caf165aab1438ff109b77ddd32e991b8b0a69adff","sha512":"7ac5308be49ee81fff510e3d24e13ac74a8a6d69821206891d8e8a82542370041a96fb5012228d6288aa1c3892b3b4d6ee558d608c84817a858b19611b3b74ef","ssdeep":"","tlshash":"4f51421e7eda54310b2a2830e09714a3a009dad11c1dc721b9204d9d79b1d96cdb3fef","first_seen":"2025-10-04T05:11:03.439288Z","last_seen":"2025-10-07T18:16:30.141403Z","times_seen":8,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BVJD_FzT.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/BVJD_FzT.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PRWAqMjBJvrAhwnS; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=3M8ysaZTZRPIYh4y; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-200\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 301\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":512,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (511)","md5":"7238102902131e678624d38a52b93598","sha1":"0bbded74519658146adb846e34a258dc1d0dca03","sha256":"05cf9f3b464f937efb279653d4a70ece477c25c3db903e720cfb062a06308146","sha512":"3cc8cefecce474edd6549b99baa958ada12a1a7f5b5b5f360c02a362bbc63cc7b1427b65ee0f211281de7e4f3fc0c238e7ba192aade89ce8554cb4c0aff4179d","ssdeep":"","tlshash":"1ef09e8e70a3d2b0b777c789c937c642a47c1e52380de5d1d04a5a45324b481e73d72e","first_seen":"2025-10-04T05:11:03.419457Z","last_seen":"2025-10-07T18:16:30.061836Z","times_seen":8,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/entry.B0BOi0i9.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.592Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/entry.B0BOi0i9.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=skkoX6gsNOiwKWZX; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=BoPEpWBIwjswwKi6; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-1080\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 751\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4224,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4223)","md5":"61f0bd26cea7d117c5e7c486acc68d00","sha1":"6c8bcb0f1c4f0fb0f07276c5eacd898124ed10df","sha256":"f099b430b92e0f00145cb9382b4a9ae5fd988a1e4f4bfb3043e5a938efc4ee39","sha512":"f9bc1136e2349b7ac1471ec7801d8047312f950e30808796e33dcc45bdf4cc68b709d9a30c6ae3f2cc7371b4d47bd532b8cc59e09569e52f1d9a1b30cb0b91c2","ssdeep":"48:qBK1KVrwxo7yXr29OKJgbKA7cb2XYKBKJKeKbKaeEaSkeEnS0SSSWS8VSfHeEPeG:qxi8yK9RHN4MEBWWXIShv7JRhW4D/qi","tlshash":"4491ff7fb288f6580127ff02a4a15bddf42b23b0b2522a15f2d5523061b67d1bc29d7c","first_seen":"2024-05-30T05:56:49Z","last_seen":"2026-06-10T14:34:42.966261Z","times_seen":189,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/home/play-icon.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.240Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/home/play-icon.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/Home.puxSNRNF.css\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=2SjtDWzNhgr0D5Bn; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-564\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1380,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"89eda723c8dba836950c26b67cd04524","sha1":"9f3e34d6eb95f2e0b5fc9da99bc3928d70302684","sha256":"6d7e4782409131c0723e253d83d2849be4634cbefdf9d2ae6c5ad0cec9b08a32","sha512":"bc29d80eb47fc508f60d1e6aa660bea59af4ac72c608fb52c4b11b18712da727706b0029a25bb58d525e2031e9b69bb0f12664dae2514b85a222281d605c1768","ssdeep":"","tlshash":"b621823cd25c5c7bdb67827cda195465221e13de63c9431c7198df1e18344cb690fae4","first_seen":"2023-05-21T11:43:22Z","last_seen":"2026-04-15T02:03:05.921793Z","times_seen":79,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"us.i.posthog.com/batch/","fqdn":"us.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.216.175.216","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:58.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B2:07:A5:B7:4A:00:EA:45:09:50:EF:4B:44:63:83:38:E2:97:F8:13","sha256":"6D:1D:1C:48:82:61:EB:EF:E4:D8:57:9A:EA:F6:ED:0A:07:BB:6C:17:71:6F:A3:F1:88:57:DC:E3:A4:E8:44:96"}}},"request":{"raw":"OPTIONS /batch/ HTTP/1.1\r\nHost: us.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://www.gwdt26x.life/\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 07 Oct 2025 05:13:58 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: https://www.gwdt26x.life\r\naccess-control-allow-credentials: true\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-methods: GET,POST,OPTIONS\r\naccess-control-allow-headers: content-type\r\nx-envoy-upstream-service-time: 0\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":93,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":93,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/vue-splide.C9Z0wB1j.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:46.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/vue-splide.C9Z0wB1j.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=7HPltmSLSzY7vLXp; __ddg10_=1759814025; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=LWbxIOKeW6h0neia; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg10_=1759814026; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-734\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1844,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1843)","md5":"e638a23113de5c173bd45cf1ec17cedd","sha1":"5e71875f9d7d6d3240729a9300e2be7b2c49d0d2","sha256":"25fecdb4c8330c6bfab65a09dbb53c0d8f407344f2ba4f4438bb48293444c846","sha512":"c76d640e7077019c6c609684d476a47b812c67eb4fbc8cf85240d2bc6e96e5254434483c8c8046b15b3683e09c749b26055b48f9656e0dbf5d78bad8aa18872c","ssdeep":"","tlshash":"fd31442240c92f599843973229bdd7a964eec2534e6302baeaded320468ad4d07e49cd","first_seen":"2024-08-20T04:44:02.347145Z","last_seen":"2026-07-20T07:08:57.528836Z","times_seen":137,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/4v6vyIur.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/4v6vyIur.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/CkMSVCQx.js\r\nCookie: __ddg8_=NpQnmSkRWdbOXQAW; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=fTJ4DMruRLcVAJr0; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-215a2\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 30346\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":136610,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (43811)","md5":"10c92c717f8762cb181545e7d2c6b331","sha1":"712d5130ad1deb5bae8e8e479a21d4908274dd34","sha256":"dfc421c8fbb78ff109f24399be0a334cbf47b3b407cf2bc5c31f50e2da4cd9a0","sha512":"34893e23627e8ef59a86fd8bec5618574feca8590438c4edd0f6f59efb2cfd25ed0b3bc334c2d4afe53e9e96f45ca65bb651f5ac475760cbcb269ac3a6c6eb23","ssdeep":"1536:QsrUHXu9+2FYnFjqN1q46HAXJF707AMvrHCRAxpdh5CVaJwBNI5tdJked5qK:QxHXuw2FYW2T5Sa1RdD","tlshash":"bed35f4b4e0c0e7a056217b12fada7b362acc07471dbc3e557bf82182375475aea279c","first_seen":"2025-10-04T05:11:03.528287Z","last_seen":"2025-10-07T18:16:30.112258Z","times_seen":7,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/api/v2/tracking/events","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.815Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"OPTIONS /api/v2/tracking/events HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: PUT\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://www.gwdt26x.life/\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":19,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/q3LSfRvN.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/q3LSfRvN.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=d5ET1npgkspj930j; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-1896\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 2896\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6294,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (6293)","md5":"aabcaf406092d2abfaf2865f8d6c345d","sha1":"dff4a863c03268754af54820528972e654b1b835","sha256":"3f9400210e7096afbc7663147fe16f41f85982ac363d1c8506040c5b38572ca2","sha512":"f9af6f7a796692d9ac07af0d7f8e19762d1fb44cf80af21335aaca29f928c5008d33e2156c039095e45a8590d25edf2bdb42d2dec34d2314d057f02001b773a2","ssdeep":"192:PpazyEaxrcxshi0pM3bumtmRNwDA8T4uC3/bR5AmMbgj9ak9rLX:xazyEaZcxshi0+SPQDvk/F5rMS9aeP","tlshash":"30d11bccb4a67021b3774ae5d0b78107763829a134cbd4e1e01eded73e15a62a792d8d","first_seen":"2025-10-04T05:11:03.316834Z","last_seen":"2025-10-07T18:16:30.09229Z","times_seen":8,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/images/cursor.png","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.843Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /images/cursor.png HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: image/png\r\nContent-Length: 591\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nConnection: keep-alive\r\nETag: \"68daf6ab-24f\"\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":591,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 17 x 27, 8-bit/color RGBA, non-interlaced","md5":"4fa7bdcd138f8aee5178f0d4f926595b","sha1":"6d3a5103766e97395bebbd2ffe811b2e7ad3c7c0","sha256":"a1fb1b429d644ad011e6bd98701d1951138d3f973bda19ce3411e1c1d65ef35e","sha512":"81d75aeb19459f946924b46919bc1c4f447dfc0a0b56915ea19edfca282ea936c4b58a9d417459fa1b41982380200b3a894a8fda09faeab075556defcec883a3","ssdeep":"","tlshash":"fbf047cd4d715339af5e04d190f714a8fc45228a2460a51c4e0fd01a3d85055fe0d34f","first_seen":"2023-05-01T22:32:10Z","last_seen":"2026-08-15T23:16:20.914263Z","times_seen":2306,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/q3LSfRvN.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/q3LSfRvN.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PRWAqMjBJvrAhwnS; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=xjEEBIx1kfm2vx5Q; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-1896\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 2896\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":6294,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (6293)","md5":"aabcaf406092d2abfaf2865f8d6c345d","sha1":"dff4a863c03268754af54820528972e654b1b835","sha256":"3f9400210e7096afbc7663147fe16f41f85982ac363d1c8506040c5b38572ca2","sha512":"f9af6f7a796692d9ac07af0d7f8e19762d1fb44cf80af21335aaca29f928c5008d33e2156c039095e45a8590d25edf2bdb42d2dec34d2314d057f02001b773a2","ssdeep":"192:PpazyEaxrcxshi0pM3bumtmRNwDA8T4uC3/bR5AmMbgj9ak9rLX:xazyEaZcxshi0+SPQDvk/F5rMS9aeP","tlshash":"30d11bccb4a67021b3774ae5d0b78107763829a134cbd4e1e01eded73e15a62a792d8d","first_seen":"2025-10-04T05:11:03.316834Z","last_seen":"2025-10-07T18:16:30.09229Z","times_seen":8,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/default.0Z-hrgpm.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/default.0Z-hrgpm.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=ifRSlUc17inOJ7tI; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=tySZ2DdjxraAdiMC; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-b495\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 7659\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46229,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (46228)","md5":"87f35b3ae9a4a2498c3d3e43fefa4d55","sha1":"05b23a7b14fc1e1e5a0ff9038a182a3f671d0723","sha256":"447918c8ea5df2d6d6a956b41bff24ce4b3caa7e5a1fab8d1acc20bba7d7b3d9","sha512":"1bc2892e95efe283b77173a9bdd47e9de3e26fcc00ff14d405ba9e85a6575f19698c8ec0499600291d4a2d91a4896906a795aef37b2c67f7d4930215070b4634","ssdeep":"384:G0jQN6Dc0cWJ7Hv0Dyikxb4v0DyiSft3JnymteZFcy/xqFnMRfv6rfD:LrtHvkQGvkU6PDwSM","tlshash":"90236621771c607cb53bc9a2b490169e2039f707d5239faeed693629c9c71d32b627c8","first_seen":"2025-10-04T05:11:03.495513Z","last_seen":"2025-10-07T18:16:30.109244Z","times_seen":8,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Chd1ThOZ.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Chd1ThOZ.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=3H26EdJU7S1qVPii; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-47f\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 678\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1151,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (1142)","md5":"317a2201ef3851dba19e8b41380c8518","sha1":"69f8afc7452ae5bbffe308672417d74ea784cee0","sha256":"64cbae9ec71c97c3ca661b3a42c7f0de57972f702378830b7911e5a148b1cb0b","sha512":"4d8e02b904019b8bc965749301e7a14aa67543e54a8b2a19862be134620f94b55e7a2481c50590bf05fc5b7f6ce8e54746b77e238fa7b3a83fbaf81345be42c0","ssdeep":"","tlshash":"372130aebb3aa7bc7c245a5f42306f30f0132096ffb8945cb8d22126e3425a155640b8","first_seen":"2024-06-08T05:57:25Z","last_seen":"2026-05-26T01:50:53.816934Z","times_seen":119,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/games/casino/highRollers","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.284Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /games/casino/highRollers HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":46,"dns":0,"connect":20,"send":0,"wait":0,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/api/v2/banners/main","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.287Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /api/v2/banners/main HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":40,"dns":78,"connect":97,"send":0,"wait":0,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ext/cdp-customer/v1/analytics-js/snippet/233e4c5f9379d04ec864/analytics.min.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ext/cdp-customer/v1/analytics-js/snippet/233e4c5f9379d04ec864/analytics.min.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=fTJ4DMruRLcVAJr0; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=ifRSlUc17inOJ7tI; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: text/javascript\r\naccess-control-allow-headers: Authorization,Content-Type\r\naccess-control-allow-methods: \r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\netag: W/63cded814d76830c4a89761ebeb3242e\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncache-control: public,max-age=300,immutable, no-cache, no-store, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\nservice-worker-allowed: off\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":106254,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"009ba376452e3bdba0f98538c0575d44","sha1":"7fc6cb65590b122da408e8206cbebe360498ffed","sha256":"c31bef488aa8dee63ffe8601ea74d02285c0e9f189ff5540a94637b3a0fe99d9","sha512":"925ed13622d0b785921820f1b52ab0ad19ad44b8467ec1e15dfb03c9327dbd16ef037e1f11f9fdf80cbc4d9104c08a62c02b4651786efad4547aa5dc11dfe89b","ssdeep":"768:0xOyftQBCLo1sw/cexpme6piT5nQk8v2RbgFoF4OnImsSfWdLyWQL9ZsBpi0vRxv:UtQBQo1sAIeaE5Qk8uV4oF4OvpU5xMMf","tlshash":"d6a383c8f6e6f060439364b8803f110bf23e795e680e84a4f266d9d66cbc59d9127f79","first_seen":"2025-09-05T15:12:16.336085Z","last_seen":"2025-11-07T14:36:24.450735Z","times_seen":219,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"licensing.gaming-curacao.com/validator/?lh=511aadd110f565d008810403b6cffb85\u0026template=tseal","fqdn":"licensing.gaming-curacao.com","domain":"gaming-curacao.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.231Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /validator/?lh=511aadd110f565d008810403b6cffb85\u0026template=tseal HTTP/1.1\r\nHost: licensing.gaming-curacao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DlAUqK2U.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DlAUqK2U.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PRWAqMjBJvrAhwnS; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=lQNs5AFy21MmXOqY; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-5b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 82\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":91,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"25e3a5dcaf00fb2b1ba0c8ecea6d2560","sha1":"7850b3fd4aeb69387bdb5a60025d15c41351d5eb","sha256":"cb85b0f263dbe24e857338301c0627076592e9f1f1a5662929f86d2c126444aa","sha512":"2e5cc9b53d5641147f68c73e5db0442d93fb6a64da45cfc051da5550a2fad07e912e651bd730e54325ef74eb706be0c5df612355c1dca144ab6e9cc8c4ecc73b","ssdeep":"","tlshash":"1fb012c81cc3e078939818d47738c15844380448310742b0808c0943e2c20809797c1d","first_seen":"2023-03-08T16:39:49Z","last_seen":"2026-08-17T14:42:22.540243Z","times_seen":25631,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/roboto-regular.BtWrZLw2.woff","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.657Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/roboto-regular.BtWrZLw2.woff HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=JrkLqISG1OoCRa1A; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=ecNz5j6xDjGmP4xJ; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: font/woff\r\ncontent-length: 139160\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: \"68df7ca1-21f98\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":139160,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 139160, version 1.0","md5":"ae91f35c10375f1dab7137a298aba7c9","sha1":"6b9aae9dddb20bdfc56381f0d64bf54433977413","sha256":"264a621481c81a289ac3227cd63cc91902de13789dd9df920f0e2f465fa2bd38","sha512":"b0253e74fe7baf39316ec12622b1ace4899c51f6ce5c193e0ca2dbf713e4e1ce3d5ed4145d46680a91c68baa44bd73a31834e544c0d732f77975e72424151b60","ssdeep":"3072:2isY+Dpc1q2EHUmPsBut5j+mN9s+EIUb0Psp45nE:Tspc1s0osS5rc0Er","tlshash":"60d31255eb38110ff8be77f86dcad33408f471d5c7a322a4955802abae44fd4ea24da1","first_seen":"2023-04-14T07:00:11Z","last_seen":"2026-03-01T21:47:53.345572Z","times_seen":69,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/ccm/collect?en=page_view\u0026dr=www.gwdt26x.life\u0026dl=https%3A%2F%2Fwww.gwdt26x.life%2F\u0026scrsrc=www.googletagmanager.com\u0026frm=0\u0026rnd=1585185735.1759814028\u0026dt=GET-X\u0026auid=1526880181.1759814027\u0026navt=n\u0026npa=1\u0026gtm=45He5a32v9186219929za200zd9186219929xea\u0026gcd=13l3l3l2l1l1\u0026dma_cps=syphamo\u0026dma=1\u0026tag_exp=101509157~103116026~103200004~103233427~104527907~104528501~104684208~104684211~104948813~115480710~115616986~115834636~115834638\u0026tft=1759814027929\u0026tfd=1037\u0026apve=1\u0026apvf=sb","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:34:18 GMT","end":"Mon, 08 Dec 2025 08:34:17 GMT"},"fingerprint":{"sha1":"33:09:D4:D3:61:83:44:73:CF:04:5A:44:53:2E:B5:36:64:BB:FC:7F","sha256":"86:F0:16:7D:8B:24:BC:17:6C:2B:06:E6:05:A6:33:43:10:A0:61:A6:BA:81:FB:58:ED:0A:DC:0B:AE:5D:08:C6"}}},"request":{"raw":"POST /ccm/collect?en=page_view\u0026dr=www.gwdt26x.life\u0026dl=https%3A%2F%2Fwww.gwdt26x.life%2F\u0026scrsrc=www.googletagmanager.com\u0026frm=0\u0026rnd=1585185735.1759814028\u0026dt=GET-X\u0026auid=1526880181.1759814027\u0026navt=n\u0026npa=1\u0026gtm=45He5a32v9186219929za200zd9186219929xea\u0026gcd=13l3l3l2l1l1\u0026dma_cps=syphamo\u0026dma=1\u0026tag_exp=101509157~103116026~103200004~103233427~104527907~104528501~104684208~104684211~104948813~115480710~115616986~115834636~115834638\u0026tft=1759814027929\u0026tfd=1037\u0026apve=1\u0026apvf=sb HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/plain\r\ncache-control: no-cache, no-store, must-revalidate\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\npragma: no-cache\r\nvary: Origin, X-Origin, Referer\r\nserver: scaffolding on HTTPServer2\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: https://www.gwdt26x.life\r\naccess-control-expose-headers: date,vary,vary,vary,server,content-length\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.gwdt26x.life/collect?r=8773500","fqdn":"api.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.640Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"POST /collect?r=8773500 HTTP/1.1\r\nHost: api.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 56160\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":1,"connect":22,"send":0,"wait":0,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"api.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DRLB4-_R.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DRLB4-_R.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=yohVisqaaBwKKZ4q; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=kk4ytHgvAUbaqv1G; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-201\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 276\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":513,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (512)","md5":"edbd750ef08a3e40bd3f93ef00424804","sha1":"2910560cc99b8e5fcf85488d82a39cdc3d45c09c","sha256":"19c614190f4a1ff133dd089486879e169ff387fc1dcddaf2177eb99e03b86f4f","sha512":"78fb844b4a23955443ad1a90c1ece096cf92e30a1b05a64a80d332774ad2063a4491e18a2a2afc1788c7762670f8638d1833868ff05f3775eeedec6acf4fd290","ssdeep":"","tlshash":"d5f0508b1caa18941de65f779027b1d2337a516e01518085feb1e6c4a10759ef32f430","first_seen":"2025-10-04T05:11:03.352335Z","last_seen":"2025-10-07T18:16:30.062849Z","times_seen":8,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CjIjlGq-.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CjIjlGq-.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=gDUZhxQsctf8K2MH; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-9ce4\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 12832\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40164,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"8536f2f542c30c3b37aa68fa9d57f5cb","sha1":"4679e0eb2b374266ccf64bfc73ac98dad5143a1d","sha256":"84a0b743a7ef37e6cd2a2db660b4b5899c3fecce9d1f28502709614fc9d191fa","sha512":"126dd430ac683507fae1c2a1e11c5ff94a9015441798342ca77791fe29709b30c33f8b30ff1b10b1f08b51fac27d016fed4b2f8e724afb82dd8b57c2fbc7fbfd","ssdeep":"768:kC43aMGeQtDCPB/HyzE0qct7yxP2C7dSlSxkPut06BcftOashQWEhQEq/iiB8faZ:760xiywcV64IX","tlshash":"e303f8c8b2a0506583e2a1a390750203f33999153409855cbb2ceefbad7eeda7177f75","first_seen":"2025-08-19T01:32:32.322521Z","last_seen":"2026-04-26T08:04:42.226428Z","times_seen":67,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/analytics/events?event_name=time_first_load\u0026pgi=GTM-KN757LMM","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.598Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"POST /analytics/events?event_name=time_first_load\u0026pgi=GTM-KN757LMM HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 618\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=AWEyf8ejeKyNroUA; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=ag2VI5QKJ8Zd7mk7; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":215,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":215,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DxTym_EP.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.224Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DxTym_EP.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=3M8ysaZTZRPIYh4y; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=Ya40tpGQ0FISttJW; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-142c\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 2073\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5164,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5163)","md5":"a86bd43371591230ada5d1456dab8aa0","sha1":"b63e835649ce8bec3af500a596a7a1f58272afb2","sha256":"23ec8c94b2d36cce2ca68ad1e07e75f81b886d3d0077acde44ee2f5981e3ca10","sha512":"c2f22c55f07b8c50d90c20493fc7dc2b4ed68615b8adca2c23cbb0c8439285544b86a623e919ed65f23f8dd6202d553dab85551ce8953e3e9c963b24ff059899","ssdeep":"96:oeyq53hKMoKMj1W3FdeF31f5HnPx1oRstVCBR4Ir8Dtgjiby+qUECPRv5:o83BY1W3eFFvmQVCkIgJbtD","tlshash":"f5b1a7e4b1d9e09bb7b64fd1c032225260076ba57434f0d0f27aad73215be54a562b3f","first_seen":"2025-10-04T05:11:03.300471Z","last_seen":"2025-10-07T18:16:30.054069Z","times_seen":8,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/loading.gif","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:46.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/loading.gif HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=7HPltmSLSzY7vLXp; __ddg10_=1759814025; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=PsGvPX9ajJKVc8va; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg10_=1759814026; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: image/gif\r\ncontent-length: 11144\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-2b88\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11144,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 64 x 64","md5":"e4d96bb51227829e536412e5392bdf74","sha1":"8bf350e63f7bc86615cdccc6d16e0c8abb00584a","sha256":"d2911698581f2b0f538c0d770d1b677ecad7b9e61e99d89d1f218f9dae6c31cd","sha512":"a580b7ee3f1a213a523cc8ac69662809cd21bf0952aa2767ea1c3a8ddf934a3a34c4c578d34525d54ab027915aa9097894545713f135126bb8cf7f280b8ab0e6","ssdeep":"192:Yx1zq53A3H8YLSfEdDNsS+4tygrQFFpslGsTg1z4cWl:MH38WdDNk4Ygkrmwj5Wl","tlshash":"5a326d2c1ca447e6e927463165dba2cb8811df2d226c18d39eac347fb95b23ee0dcd10","first_seen":"2024-12-10T17:19:34.10667Z","last_seen":"2026-01-21T08:18:56.850207Z","times_seen":57,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":105,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/ccm/collect?en=page_view\u0026dl=https%3A%2F%2Fwww.gwdt26x.life%2F\u0026scrsrc=www.googletagmanager.com\u0026frm=0\u0026rnd=1912786443.1759814027\u0026dt=GET-X\u0026auid=1526880181.1759814027\u0026navt=n\u0026npa=1\u0026gtm=45He5a60h2v9186219929za200zd9186219929xea\u0026gcd=13l3l3l2l1l1\u0026dma_cps=syphamo\u0026dma=1\u0026tag_exp=101509157~103116026~103200004~103233427~104527907~104528501~104684208~104684211~104948813~115480710~115834636~115834638\u0026tft=1759814027051\u0026tfd=2367\u0026apve=1\u0026apvf=sb","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.250.74.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:37:19 GMT","end":"Mon, 08 Dec 2025 08:37:18 GMT"},"fingerprint":{"sha1":"71:09:AD:C8:6A:D2:25:DB:C9:D9:5E:5B:C1:06:E1:0D:D6:39:D6:F0","sha256":"A9:72:F7:39:49:86:27:92:AA:EE:65:04:99:A9:0E:A8:02:70:01:E6:72:46:C2:FB:DC:5E:5E:6B:DC:B8:27:A0"}}},"request":{"raw":"POST /ccm/collect?en=page_view\u0026dl=https%3A%2F%2Fwww.gwdt26x.life%2F\u0026scrsrc=www.googletagmanager.com\u0026frm=0\u0026rnd=1912786443.1759814027\u0026dt=GET-X\u0026auid=1526880181.1759814027\u0026navt=n\u0026npa=1\u0026gtm=45He5a60h2v9186219929za200zd9186219929xea\u0026gcd=13l3l3l2l1l1\u0026dma_cps=syphamo\u0026dma=1\u0026tag_exp=101509157~103116026~103200004~103233427~104527907~104528501~104684208~104684211~104948813~115480710~115834636~115834638\u0026tft=1759814027051\u0026tfd=2367\u0026apve=1\u0026apvf=sb HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\npragma: no-cache\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: text/plain\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\nvary: Origin, X-Origin, Referer\r\nserver: scaffolding on HTTPServer2\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: https://www.gwdt26x.life\r\naccess-control-expose-headers: date,vary,vary,vary,server,content-length\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":129,"timings":{"blocked":54,"dns":0,"connect":8,"send":0,"wait":19,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/ls-cdn.amplitude/analytics-browser-2.6.2-beta.0-min.js.gz","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.819Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /ls-cdn.amplitude/analytics-browser-2.6.2-beta.0-min.js.gz HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=fTJ4DMruRLcVAJr0; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=U291tC9h7bhsgtHh; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Thu, 28 Mar 2024 00:42:57 GMT\r\netag: W/\"7300cb5f3b4294338b104c0f3268002f\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nx-amz-version-id: IogUhwUfPmM04el12d60iABuuT4mFuey\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nx-cache: Miss from cloudfront\r\nx-amz-cf-pop: AMS58-P6\r\nx-amz-cf-id: K1aVjCdm4-pvOBOgMxqo0Y0AmYa5WHOxh2hllurs2VfQ8AOty3KBXQ==\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 17664\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":66596,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a81d9804ed47201de5314a7110e680be","sha1":"df58e208599843e46894e9c2bbfdf2feb2a985a5","sha256":"59dd69f4230f7535182747c17235fe4526d34826a142498485779bfdb5d617f1","sha512":"2c15805effa726a40e1b3156d003df4b5f602ab4c1b09b8897ff759d143c0a33a5eb7cc90887b850b1f209ccb05b7be263935ad805ad86383f88947d777fdb42","ssdeep":"768:p6wmsZPARRFO/J6zZsideR53I+dte7I4GWyihZurBJ8:/msY4/JceR54+zeU4GWyaZudq","tlshash":"f35372c9f6cbf0250393a5b8907f140ab33e7e9d242d4428f626d9d53c6d6499233bb9","first_seen":"2025-03-26T18:10:08.318249Z","last_seen":"2026-06-26T20:23:29.909592Z","times_seen":142,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/loading.gif","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/loading.gif HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=BoPEpWBIwjswwKi6; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=JrkLqISG1OoCRa1A; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: image/gif\r\ncontent-length: 11144\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-2b88\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":11144,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 64 x 64","md5":"e4d96bb51227829e536412e5392bdf74","sha1":"8bf350e63f7bc86615cdccc6d16e0c8abb00584a","sha256":"d2911698581f2b0f538c0d770d1b677ecad7b9e61e99d89d1f218f9dae6c31cd","sha512":"a580b7ee3f1a213a523cc8ac69662809cd21bf0952aa2767ea1c3a8ddf934a3a34c4c578d34525d54ab027915aa9097894545713f135126bb8cf7f280b8ab0e6","ssdeep":"192:Yx1zq53A3H8YLSfEdDNsS+4tygrQFFpslGsTg1z4cWl:MH38WdDNk4Ygkrmwj5Wl","tlshash":"5a326d2c1ca447e6e927463165dba2cb8811df2d226c18d39eac347fb95b23ee0dcd10","first_seen":"2024-12-10T17:19:34.10667Z","last_seen":"2026-01-21T08:18:56.850207Z","times_seen":57,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BVJD_FzT.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/BVJD_FzT.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=T6EPiXtcqhjW0ZX1; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-200\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 301\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":512,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (511)","md5":"7238102902131e678624d38a52b93598","sha1":"0bbded74519658146adb846e34a258dc1d0dca03","sha256":"05cf9f3b464f937efb279653d4a70ece477c25c3db903e720cfb062a06308146","sha512":"3cc8cefecce474edd6549b99baa958ada12a1a7f5b5b5f360c02a362bbc63cc7b1427b65ee0f211281de7e4f3fc0c238e7ba192aade89ce8554cb4c0aff4179d","ssdeep":"","tlshash":"1ef09e8e70a3d2b0b777c789c937c642a47c1e52380de5d1d04a5a45324b481e73d72e","first_seen":"2025-10-04T05:11:03.419457Z","last_seen":"2025-10-07T18:16:30.061836Z","times_seen":8,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/l/v/poll?action=poll","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:59.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"POST /l/v/poll?action=poll HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 217\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:59 GMT\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Length: 2\r\nConnection: keep-alive\r\nX-Webim-Version: 10.7.130\r\nAccess-Control-Allow-Origin: *\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-17T14:38:38.712515Z","times_seen":762140,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CFU304S8.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CFU304S8.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=wze3JDDW48AgXR6w; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-78\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 95\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":120,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"65b0cca89e40818f39fdd7753db6d142","sha1":"24e169a25a2e5e795d2ba4918ad600ab939bc23a","sha256":"261a0d9b3884cb4797de2dd31290199dbcec4f295a6ca9ee2c3b48ab9d9651ce","sha512":"e4c57b7230da955929c01aa05a22c6039a4ab395d6480587e21169106ce56e84aa99238c37d03c5944a72a6c799d55cc072ee59b5e498caf41fd1f6e021b43be","ssdeep":"","tlshash":"53b092d6728a3ce12602b810a15b80b4a131e6240b8a47208026f08739724a48a52e38","first_seen":"2024-12-07T17:14:43.577967Z","last_seen":"2026-08-04T09:28:00.148891Z","times_seen":102,"resource_available":true,"data":null}},"time_used":38,"timings":{"blocked":17,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/js/fp2.min.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /js/fp2.min.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=b0YNNm9gJaZYD0tj; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca2-883d\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":34877,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (34698)","md5":"02087a3f4f46b15bc198570d800bff41","sha1":"e59f5e3521d8c60e5772de1f65c90e5b87d9eb9e","sha256":"e753042decd90a96d0636a7df16df556860af92ca09ac37f0f6ab1d574acd1f1","sha512":"2c733c348e26c0b400befd5ccac6734eb06a0ca0c8c638f8d3a66afd75ea5860c6cfd3a913ba6dd6824bd9c629c2f28d14204efa625b10fa8fd9b366ba82c968","ssdeep":"768:J2N6EbuZaWRhGT8e20R5J++t6cOrVrzib:oxuZaWRhGoF0R5UVra","tlshash":"e6f21b96b2e8373c8143b063394bec15fb799495e784808a5e2d4180f8758e9e77bdf8","first_seen":"2023-07-23T18:22:17Z","last_seen":"2026-06-26T20:23:29.90284Z","times_seen":1217,"resource_available":true,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CkMSVCQx.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:45.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CkMSVCQx.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=PYvSqXr0cbZ1mIUz; __ddg10_=1759814024; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=Ny8zAgWZ7SXCKMva; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg10_=1759814025; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:45 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-75efc\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":483068,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (47660)","md5":"79068909446126a70dccef2e4c2a06cf","sha1":"3f1f59ca79626ad920c3f2ce34109d2d06ca1b7f","sha256":"8214d22013513fb9a76d56a5723c9ecbaf725ebb9beff448232c77e30a459faf","sha512":"437b07be547ebde1a4dac1fdcfbdc3521519d219b964b3e1cb959bbf76c98f5165fc8af5ed54a44cb436d8b827326c03020820e0dd888540088fc28351669c12","ssdeep":"6144:EW2i6XYOhfa7HN9OCjhpr9SPXiBfmECS4Teq2YvnqX1SnI7mbvnQGcRjsXKAiH2i:ZXkhS7DO+hprP9mxS4VTqlSnKG6wXKF","tlshash":"6ea45ad97196b02213f619e4807b0106f3392a54384ec4e8f16d9eeb3d7690a92b7f7d","first_seen":"2025-10-04T05:11:03.286196Z","last_seen":"2025-10-07T18:16:30.070847Z","times_seen":8,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Home.puxSNRNF.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:46.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Home.puxSNRNF.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=7HPltmSLSzY7vLXp; __ddg10_=1759814025; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=PubFxzLXt8Hdezzc; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg10_=1759814026; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-7b70\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31600,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (31599)","md5":"f54b3d372981eeb830226b2cac6589f8","sha1":"5b32f6d7e1051ff1b13ef9ea8ef930004026f974","sha256":"702d9e1a9127a29bbf7a76f83f5239bb9bbef44c0f8382b79f13a38e5cd63681","sha512":"6d226b5103d1ac7895a65ec95731c3535e1f7850ce9e6c9e50c0fce4224413bd964e485e4c5ce1c686a466b23727d11d32dd712b9823a07289388c8fb030bed6","ssdeep":"384:7c9CVetr9K8r9TETMutXaYHsYCsk7JWGCIEw5+22xI:+CVl+9gT5sYCxl2xI","tlshash":"5de29931671c202db1bbe676b8e16a9d6118f507e72317b9d5d47438c8db682323aacc","first_seen":"2025-10-04T05:11:03.609866Z","last_seen":"2025-10-07T18:16:30.052681Z","times_seen":8,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/DRLB4-_R.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/DRLB4-_R.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C28Ks5WD.js\r\nCookie: __ddg8_=LhI0qLBDD4z7y5O4; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=vIroOz2aejJ6R2j4; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-201\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 276\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":513,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (512)","md5":"edbd750ef08a3e40bd3f93ef00424804","sha1":"2910560cc99b8e5fcf85488d82a39cdc3d45c09c","sha256":"19c614190f4a1ff133dd089486879e169ff387fc1dcddaf2177eb99e03b86f4f","sha512":"78fb844b4a23955443ad1a90c1ece096cf92e30a1b05a64a80d332774ad2063a4491e18a2a2afc1788c7762670f8638d1833868ff05f3775eeedec6acf4fd290","ssdeep":"","tlshash":"d5f0508b1caa18941de65f779027b1d2337a516e01518085feb1e6c4a10759ef32f430","first_seen":"2025-10-04T05:11:03.352335Z","last_seen":"2025-10-07T18:16:30.062849Z","times_seen":8,"resource_available":true,"data":null}},"time_used":40,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CYqDhD_K.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CYqDhD_K.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=3M8ysaZTZRPIYh4y; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=yohVisqaaBwKKZ4q; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-4b83\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 8159\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":19331,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (19330)","md5":"1bbfaa6ac14a0d4a4f6a2bdb50403740","sha1":"da1db6943edc34407d541bf0999bebae565a73bf","sha256":"75a2ab6b9337408f843fde1e6ecf53fab99814a48dc12f1744621095a45bc852","sha512":"585e1e94ae1be8697cb4217da30bc9a3c01726a9e4ff4664f8a888ea03fa639d8a97d603f95684fc8f37b006f0ca6b67619a74114c7924cfb1d8a1646781c6e2","ssdeep":"384:gbLmDw0GjHIVo6eR6o1Shl449OsLV5jbHQ6NhWWxZ9HqDXRoOkm4Zes:gPmDw0MHIVo64X1NdshJTQ63WUG4h","tlshash":"479295c832c7f5968793197681bf100bb23e6d85a40d8892d53ae0d87c7486c867bfed","first_seen":"2025-10-04T05:11:03.43668Z","last_seen":"2025-10-07T18:16:30.136146Z","times_seen":8,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/D5gOYdM7.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/D5gOYdM7.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=Qkoq0awwpSp4tPq7; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=olRQ3nfOt6l3R8mK; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca1-1658\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 2338\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5720,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (4252)","md5":"0b267ccd50f6720630d6f6069c3c0da3","sha1":"e807dbdb3d3f080fd9377141a80d408d5d72739d","sha256":"db98026b4bf01b51965d9e63c86fd742f4f92228b088c6fc888e39f20288243e","sha512":"196f8d868d3d7cefa816a2571e5ae57cd224d858330bb214b36e63cc31de93ef824d2bd19c0d076bc091a15a5207d2d4358688dc6e0c6ac1f65450e7ef3564aa","ssdeep":"96:v0QRrpGna8MvmCToPs9VRGJysHnwcO24BR0fTeW6ctvRqAWVtsqSE:vHRri5MeCT2sJGEN24n0XqJsqh","tlshash":"3dc186ccfa95f47a83a3f570f16f950be17b69c084585064e155e8e03cb6605c23bf69","first_seen":"2024-08-01T00:14:45Z","last_seen":"2026-08-06T18:06:56.169898Z","times_seen":135,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"us.i.posthog.com/batch/","fqdn":"us.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.216.175.216","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:58.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B2:07:A5:B7:4A:00:EA:45:09:50:EF:4B:44:63:83:38:E2:97:F8:13","sha256":"6D:1D:1C:48:82:61:EB:EF:E4:D8:57:9A:EA:F6:ED:0A:07:BB:6C:17:71:6F:A3:F1:88:57:DC:E3:A4:E8:44:96"}}},"request":{"raw":"POST /batch/ HTTP/1.1\r\nHost: us.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nContent-Type: application/json\r\nContent-Length: 2923\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 07 Oct 2025 05:13:58 GMT\r\ncontent-type: application/json\r\ncontent-length: 15\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: https://www.gwdt26x.life\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 22\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c86a47ac0d792e37182689c73fcbf6ad","sha1":"8fd92e4671341e79f0a3529ac5e9d59d38db9e78","sha256":"0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1","sha512":"827cafe34edc64ac15f9bb3d269d338f8161a08d174071ed415b8a9e78d0672327e09034445292f90b81f5a063c8606d36ee66b20e0fff0446130303d598a8d3","ssdeep":"","tlshash":"1b600000000000030fc00c00000cc03c3ff30fc0003f00c0030fc0300c030c0c00c000","first_seen":"2023-04-06T21:35:05Z","last_seen":"2026-08-17T14:44:46.01308Z","times_seen":45347,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":115,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/cryptojs-aes-format.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.524Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /cryptojs-aes-format.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=a2sVnhKeq3FlTJxS; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=oxdrvC3JaTg7w2iM; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:45 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df7ca2-5d6\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nage: 2\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 562\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1494,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"e6bc38f77922eaa6f1b23716034b4a2e","sha1":"db781b1e30c4f2a1d63d47054f0903c463cf01ab","sha256":"9ca00bddae85e30d59672da0089ea5e132df97d75a92f42114fe1befbaeaf32d","sha512":"0ad7c00c1564d77f8463dfc81003c0d6cd6ada4e3d01094331f72847f17718e4a6b2c7a2a0bcbd96a1107bc6cb9bcb1721e7b2968ae4544595ab98d39bb30c82","ssdeep":"","tlshash":"163177407debb4c287e8e1d50435a044f67b7a0ab1558ef3aa5aa404ffedf3006326e4","first_seen":"2023-03-07T18:27:54Z","last_seen":"2026-08-07T16:57:51.090464Z","times_seen":717,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/favicon-16x16.png","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.801Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=fTJ4DMruRLcVAJr0; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=GApW3fc6QuQPaltx; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 1103\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: \"68df7ca2-44f\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":1103,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"11f24fdbf91f702bda779fc31cda72b6","sha1":"675c7e4a5d8443b041056cf934a6e2f652914a62","sha256":"22680e0318483689dda6c739ddcada0864dc530300444247c87d8233b347b858","sha512":"56998c6ce69ca75e2c00756450a2c33ed491a5be0499d5003eb3638d643efb5d395705a986df5301f74ffc9c0f10c707b9e7837a491ec7afa55f349240d2087e","ssdeep":"","tlshash":"de1146d1e121e051c26614f169222480ff67407bfeff8b1afd22a4145c5a6b997f76c1","first_seen":"2023-05-21T11:43:23Z","last_seen":"2026-06-26T20:23:29.961595Z","times_seen":155,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/img/tournaments/banner-bg-desktop.svg","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /img/tournaments/banner-bg-desktop.svg HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/Home.puxSNRNF.css\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=GFUx2KqH7sh2HTuY; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 07:34:58 GMT\r\netag: W/\"68df7ca2-673\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1651,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c02768642950741c2a8d0e39f8d412e0","sha1":"118f935a0df15e0ac81aea94278cdb9becf7e2da","sha256":"3770b25538633725c3d38f810216e8e5f7404271db7f0d2c8b0451c1c8c3d537","sha512":"0b6902166f6e8a047afb84701de82dce41008465d70c73f01f0011eadfa53e0b0db1b381f346e5de57b20f806a23a8e154ef48eb8abefb190e0e215c66e7c472","ssdeep":"","tlshash":"c331dc7582ac7c1ee60dc64cc6eb4028221f41a3a3d1c5c072577b7e76384c52dbe36a","first_seen":"2025-08-09T06:39:59.150017Z","last_seen":"2026-04-15T02:03:05.874483Z","times_seen":62,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":49,"dns":0,"connect":0,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Loading.Bk2PI8_1.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:46.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Loading.Bk2PI8_1.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=7HPltmSLSzY7vLXp; __ddg10_=1759814025; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=3dNReIRamAjI0Hpj; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg10_=1759814026; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:46 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-ee\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":238,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"972ff87ed4252206f8f9d733a46cb522","sha1":"9998cd5afd3ccbd6aaa949b68fdf49bf05224cdb","sha256":"5ae8f77f7cb1ee4548d819e6f03fe4e3fbfcc50845c8ee77480d3f08a86de00b","sha512":"1dd31797719cb3c45a9694f1e7dc1bafddbe7da579d78d6aba797d4599ac185310493de67489970b64846b0d612979cae66138ad87b50721b24adbb78cfcc180","ssdeep":"","tlshash":"51d0a7d5864444530f670a3311cc5d59c8b02ec2c8be1c1eb399d1aa03492a933b7e69","first_seen":"2024-05-07T05:56:59Z","last_seen":"2026-02-25T19:06:54.055809Z","times_seen":57,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Bo795GQm.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Bo795GQm.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=NpQnmSkRWdbOXQAW; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-11d\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 206\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":285,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text","md5":"a223b34c3cdb6967c1095dc0a28a2b7c","sha1":"1959829472750c79c3b7cd33480ea6f383d6b9db","sha256":"5c8ee49059757cb7f107a35fcbff4e413488a00cd8068c8aad9e54cf53c91db6","sha512":"567feb951deb89ec211671f30b2ab5ca4c2b7c53faadb151ca813d5b6508a293037b5e4d794e0d49dc896fbe38b53cccca5caaed64f770b6b33e9e253f075956","ssdeep":"","tlshash":"2ed02bceeb7066b4bb10455d509bc752c728f90012a86ac1987b6ea13f109c6c346fe2","first_seen":"2025-10-04T05:11:03.526688Z","last_seen":"2025-10-07T18:16:30.08633Z","times_seen":8,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/v/fonts/Roboto.ttf","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /v/fonts/Roboto.ttf HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:49 GMT\r\nContent-Type: text/plain\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68daf6ab-29144\"\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":168260,"size_decoded":0,"mime_type":"text/plain","magic":"TrueType Font data, 18 tables, 1st \"GDEF\", name offset 0x96000218","md5":"73e5e33319edb8e4c97e37cdfe616cb8","sha1":"7784f765a8fd13fb67bac14cf3c11373538955c8","sha256":"f66c295bf6f985892e07ce64d2df9149416ef950f9b65420b7de2e6f5ba0175a","sha512":"658ae380ebd8cb5a040d69d0bb8ed94421013298913fc46ba9bc010c017a2e72cdf162672a94852f466a1f764aa09e0c88cb19c3e73c1d2c616d08ad0786d318","ssdeep":"3072:RCgWJENpDQoK6jS3I+/l3mRDOTAzM7t2eV2dlNvVWgHkLAHX3lbgva:PCENtQVmNO8u2eV2h3kpva","tlshash":"59245106ebcebb9ec14093f33dabdacc56efe4225d51e513c64b6011ce05468a71f62a","first_seen":"2025-02-09T09:50:26.857461Z","last_seen":"2026-08-11T14:18:48.499332Z","times_seen":273,"resource_available":false,"data":null}},"time_used":394,"timings":{"blocked":128,"dns":0,"connect":41,"send":0,"wait":96,"receive":42,"ssl":85},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"us.i.posthog.com/flags/?v=2\u0026config=true","fqdn":"us.i.posthog.com","domain":"posthog.com","tld":"com"},"ip":{"addr":"3.216.175.216","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.i.posthog.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Sun, 15 Dec 2024 00:00:00 GMT","end":"Wed, 14 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B2:07:A5:B7:4A:00:EA:45:09:50:EF:4B:44:63:83:38:E2:97:F8:13","sha256":"6D:1D:1C:48:82:61:EB:EF:E4:D8:57:9A:EA:F6:ED:0A:07:BB:6C:17:71:6F:A3:F1:88:57:DC:E3:A4:E8:44:96"}}},"request":{"raw":"POST /flags/?v=2\u0026config=true HTTP/1.1\r\nHost: us.i.posthog.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.gwdt26x.life/\r\nContent-Type: application/json\r\nContent-Length: 228\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: application/json\r\nvary: origin, access-control-request-method, access-control-request-headers, Accept-Encoding\r\naccess-control-allow-origin: https://www.gwdt26x.life\r\naccess-control-allow-credentials: true\r\nx-envoy-upstream-service-time: 4\r\ncontent-encoding: gzip\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":676,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5eef8dec628674f745d2414cba5c1c85","sha1":"55ab9db63901d802c285307466d39d908a286c01","sha256":"4b87b72dc5b985b8b15071a750e88be0cf6113ccdb6ca4b2904ee4371dad02a0","sha512":"07cd58f130f1c1c16c7614a3c77332b45ddf99dfd09d2dcb2e540a828dfda6516d0f8c3c6feec8e6308aaa196773ee287823f307c45c2b53492e7cff76387875","ssdeep":"","tlshash":"9c01dd3ef661057988159305d5d2ac588ffe06373224bc2ce0ec8491b0db4caa5b2a03","first_seen":"2025-10-07T05:14:26.723522Z","last_seen":"2025-10-07T05:14:26.723522Z","times_seen":1,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/images/gx_site_logo.png?1701674734622167","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /images/gx_site_logo.png?1701674734622167 HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: image/png\r\nContent-Length: 4133\r\nConnection: keep-alive\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nX-Cache: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4133,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced","md5":"399c0fb7ea391e714efb49d85fedd512","sha1":"2f75c2f16d1700486b582d84473972389f174d9c","sha256":"81e421fdbd5c1e1845915192ef0c15be691c374ff66aa8386d30f52ef3a8a824","sha512":"bb58440279a4d1214c3fc8800ab5d6c2ed8e9dd4016e26c493a6c8c290d2b5a03474478e70ab242968a446fe46f691adb04b451de7636c5c3af0c7fb1da0d8e1","ssdeep":"96:TjjcoQqosJxFjeAcv1TGJirAUmGT+mPxOh:TjjkyH+AUbmw+mPc","tlshash":"e9815cfa3d3233d384649a020a7d5400543b6ccfba85955e85e3c0db3d44e884ace296","first_seen":"2025-10-04T05:11:03.245529Z","last_seen":"2025-10-07T05:14:26.726458Z","times_seen":6,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":122,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":88},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/CIV1DmJm.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/CIV1DmJm.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=3M8ysaZTZRPIYh4y; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=DzT9XqiwQe50AJkQ; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-36a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 438\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":874,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text, with very long lines (873)","md5":"3bcb3cb731faa08f8e975f22576abf93","sha1":"05344c9790022a0d796fe682cfba3af36a0347db","sha256":"ee27ce8fd95c8b0501fb72850528edd31a3d0195819a462635ca117c897cc60f","sha512":"73d6c16f46985d8259360bab931cb67e77640c8585a6ef8df1950979b4eae173ae318c351dbd07548a5d6d4b28d596f35c41db8840566f386f52f61fd70fce23","ssdeep":"","tlshash":"0c118cc070a4a431c3b849c801d5abb2b55d96843de782d4e45e1d33213f89cc579b19","first_seen":"2025-10-04T05:11:03.497488Z","last_seen":"2025-10-07T18:16:30.088926Z","times_seen":8,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gx.webim.ru/v/images/files.svg","fqdn":"gx.webim.ru","domain":"webim.ru","tld":"ru"},"ip":{"addr":"91.142.87.234","port":443,"asn":41722,"as":"Miran Ltd.","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.849Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.webim.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 09:53:58 GMT","end":"Fri, 12 Dec 2025 09:53:57 GMT"},"fingerprint":{"sha1":"61:27:85:A8:38:1C:25:65:78:46:2F:EB:0D:19:3D:18:77:6D:AF:29","sha256":"97:98:CF:E8:F7:F2:FB:80:66:4C:5F:C5:F7:97:B9:3E:B2:86:BC:56:11:C6:BA:D5:EA:6A:25:FF:FF:68:CD:F7"}}},"request":{"raw":"GET /v/images/files.svg HTTP/1.1\r\nHost: gx.webim.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 07 Oct 2025 05:13:48 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 11762\r\nLast-Modified: Mon, 29 Sep 2025 21:14:19 GMT\r\nConnection: keep-alive\r\nETag: \"68daf6ab-2df2\"\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11762,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a05b040566ca5377535a07f94adb66ac","sha1":"fd3d544bf14f3c9ad33f6c9d17a861371d7b684d","sha256":"e85418c502fc12e921c30c21ab3c5ab58dd063e19b73fa231bd0d7bec2a605a7","sha512":"346d1a3979f32959851081a764e87950a602560638e9f87594569c395b6347844338faebaf8016982e269134978867497ad4152e6e4cd86ad681e61f09f21730","ssdeep":"192:y3IN8A3nLn/NTLpsCPeweE/c+okq+eRuDUfMYzLnoP+VhwOwyHN2ELrh:wIN8uLFUOom4zLnoPqhwVQhXh","tlshash":"0b321bb23efe2a843ef19e75852073f59cf1bd152485d22688da7202313364c8e9e5f9","first_seen":"2023-11-18T23:23:23Z","last_seen":"2026-08-15T23:16:20.923938Z","times_seen":1807,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":125,"dns":1,"connect":41,"send":0,"wait":40,"receive":0,"ssl":85},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/eurostile-regular.i2b9H2-b.woff","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.657Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/eurostile-regular.i2b9H2-b.woff HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=JrkLqISG1OoCRa1A; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=F6eIclurcg1JNaMH; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: font/woff\r\ncontent-length: 97680\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: \"68df7ca1-17d90\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":97680,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 97680, version 1.0","md5":"535b1e86232aafcca96b143529c8226d","sha1":"9408a42efc92ea6972f4d0f50560c22ca84d8a08","sha256":"c5a7a7d506426bb073f4f866f0ea9f3c57c8e856444e5403494d9db263e85671","sha512":"b54f1a43cd21271056f02d0626c573357b3ad962969d24a7c03914513d6644155108d5fb0608d47c734e650e1141de70cb9cc13e1ee1f08830c33ecd7dbb8abf","ssdeep":"1536:mndVS5OB0M0Lfxv9JKgzmzwv25WCnEx2pW594UIi/m3KYdu+WLSkNQ:mv3BbuX0gswcIb4UIi/m3K4u+B1","tlshash":"95a312039a03b7246d764afa2eaf4b39f5d4ef988d0d63c147e1a410194d52f2f6126f","first_seen":"2023-04-14T07:00:11Z","last_seen":"2026-04-25T06:32:47.453739Z","times_seen":81,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/ns.html?id=GTM-KN757LMM","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.72","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.817Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:34:17 GMT","end":"Mon, 08 Dec 2025 08:34:16 GMT"},"fingerprint":{"sha1":"71:28:4D:CB:A8:43:CE:20:8D:C2:D0:1C:15:47:53:FB:EE:1F:E6:6C","sha256":"FD:F8:A3:C0:21:C0:03:15:43:2F:C7:36:8C:50:6A:39:57:B4:06:6A:0D:82:33:AB:55:A7:80:D2:E3:79:B8:11"}}},"request":{"raw":"GET /ns.html?id=GTM-KN757LMM HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: br\r\nvary: *\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-embedder-policy: require-corp\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 92\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":268,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"4aab75dcb6382c39dae33c9a1b45e608","sha1":"a8e4758330308a44ca74242cb17591e6c6599483","sha256":"d818a014761cd9516d1b3e296946e960d91f4c917bf42a808e67323a8b062da8","sha512":"0fe058db29f10d9f41db7b0cc9cbe8e403b36b07fa7a99b9699ce7cf60748d248d8a79b1a56f4bb006d507059fbe8ab73ce71b9a44ee095a6da8dea54da625ab","ssdeep":"","tlshash":"2fd09b4fd0013404d92052b05cc2776414516544f5e58d536582f4355d44755cd53158","first_seen":"2023-04-05T07:30:22Z","last_seen":"2026-08-17T08:21:27.478736Z","times_seen":5103,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ssogtx01.cc/go/auth/code/check?url=aHR0cHM6Ly93d3cuZ3dkdDI2eC5saWZlLw==","fqdn":"ssogtx01.cc","domain":"ssogtx01.cc","tld":"cc"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-07T05:13:46.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.ssogtx01.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 14 Sep 2025 05:55:00 GMT","end":"Sat, 13 Dec 2025 05:54:59 GMT"},"fingerprint":{"sha1":"85:B6:FE:D4:60:19:28:2D:C7:FA:03:A6:AF:30:8D:4D:A4:C2:2D:56","sha256":"A5:B1:3F:85:4B:67:96:6E:D6:6D:B6:C5:DA:59:E5:40:9E:62:D2:47:8D:53:A5:8F:39:58:84:83:5B:D4:1C:FC"}}},"request":{"raw":"GET /go/auth/code/check?url=aHR0cHM6Ly93d3cuZ3dkdDI2eC5saWZlLw== HTTP/1.1\r\nHost: ssogtx01.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=s6rNygRkhlt5DfcQ; Domain=.ssogtx01.cc; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.ssogtx01.cc; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.ssogtx01.cc; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg1_=qBhvZHZYBpfhjG2gZLOw; Domain=.ssogtx01.cc; HttpOnly; Path=/; Expires=Wed, 07-Oct-2026 05:13:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:47 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: private, must-revalidate\r\nlocation: https://www.gwdt26x.life/\r\npragma: no-cache\r\nexpires: -1\r\nvary: Origin, Accept-Encoding\r\nx-request-id: a29d50f9-e687-4195-9d29-f06222b410b2\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-fastcgi-cache: BYPASS\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":404308,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T14:43:00.040018Z","times_seen":17938268,"resource_available":true,"data":null}},"time_used":653,"timings":{"blocked":266,"dns":185,"connect":20,"send":0,"wait":120,"receive":0,"ssl":61},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"ssogtx01.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Loading.Bk2PI8_1.css","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.655Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Loading.Bk2PI8_1.css HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=JrkLqISG1OoCRa1A; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=WK8RV0s20vQY1w24; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-ee\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 144\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":238,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"972ff87ed4252206f8f9d733a46cb522","sha1":"9998cd5afd3ccbd6aaa949b68fdf49bf05224cdb","sha256":"5ae8f77f7cb1ee4548d819e6f03fe4e3fbfcc50845c8ee77480d3f08a86de00b","sha512":"1dd31797719cb3c45a9694f1e7dc1bafddbe7da579d78d6aba797d4599ac185310493de67489970b64846b0d612979cae66138ad87b50721b24adbb78cfcc180","ssdeep":"","tlshash":"51d0a7d5864444530f670a3311cc5d59c8b02ec2c8be1c1eb399d1aa03492a933b7e69","first_seen":"2024-05-07T05:56:59Z","last_seen":"2026-02-25T19:06:54.055809Z","times_seen":57,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/Dacnxtee.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/Dacnxtee.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/_nuxt/C72coOWc.js\r\nCookie: __ddg8_=WckjYPrAUsF1O5Zq; __ddg10_=1759814027; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; ssoRedirected=true; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g0$t1759814027$j60$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=GEprpG2qMEO3q0EC; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg10_=1759814027; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:47 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-56\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 1\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 86\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":86,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Java source, ASCII text","md5":"320ec157fca2c96c27d5b58c11f14b89","sha1":"e0e5dcfb335de172aab5aaab6508452391e5c3f1","sha256":"afd2b3f48c1cce3897968123d1242e363126ef7fcfa9cb926362b79efcc7d4c5","sha512":"83a0fdbfc245ffe78730b87d76e85b4111d45fca04b25835a6cd24961857e9f68ff3bc21519d21ca8561d0acc704396c2144ca92393e78030ea6048c559c3794","ssdeep":"","tlshash":"a3a0120a0450007d208608e4675b509955e0142613b55a8100004a0106154de650cc00","first_seen":"2025-10-04T05:11:03.670272Z","last_seen":"2025-10-07T18:16:30.094419Z","times_seen":8,"resource_available":true,"data":null}},"time_used":38,"timings":{"blocked":16,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/eurostile-bold.CvV91m_H.woff","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:48.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/eurostile-bold.CvV91m_H.woff HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=gDUZhxQsctf8K2MH; __ddg10_=1759814028; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyNzg1NCUyQyUyMmxhc3RFdmVudElkJTIyJTNBMCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=N6kUZdaQKsnVh3st; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg10_=1759814028; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:48 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:48 GMT\r\ncontent-type: font/woff\r\ncontent-length: 96804\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: \"68df7ca1-17a24\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nage: 0\r\nddg-cache-status: MISS,MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":96804,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 96804, version 1.0","md5":"2e116fd896b19f31034b0dec4106d2e1","sha1":"530e6e27f2941307b1e26f260c3a4ccf855fbe7a","sha256":"428c1711732ee01fd5bbbf9d3a4a777a83414f1894f5399d77b22dd3bd50c523","sha512":"3eada120506cc1280dbb2e199acd4a386983f855771ca0e71bd2cb810d26ac50436165ff029c8c58e0506471675d5db59e7519781495e763fda70c1ee8fe9061","ssdeep":"1536:sBOXXEUF4boG1Y6VafRnAPwQIF+RqAW3z+57es+v39nzdEvF7y4TGRYhgil:WOHEUabN1YcalOIFMqZgCsI3dREW4Tr1","tlshash":"b4931220d9f1293570275f7e60deb491bb04ad5068e07ece2873cc569fede64b729920","first_seen":"2023-04-14T07:00:11Z","last_seen":"2026-03-01T21:47:53.474623Z","times_seen":56,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":61,"dns":0,"connect":0,"send":0,"wait":88,"receive":108,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gwdt26x.life/_nuxt/BqzaD3Pl.js","fqdn":"www.gwdt26x.life","domain":"gwdt26x.life","tld":"life"},"ip":{"addr":"186.2.165.80","port":443,"asn":59692,"as":"IQWeb FZ-LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:49.314Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwdt26x.life","organization":""},"issuer":{"commonName":"R10","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 Aug 2025 04:30:20 GMT","end":"Mon, 10 Nov 2025 04:30:19 GMT"},"fingerprint":{"sha1":"C5:48:61:04:29:13:F0:88:91:C4:E5:FB:B1:92:AE:03:50:46:C2:26","sha256":"F5:20:F3:C9:80:15:EB:9E:0D:13:A6:35:B6:67:FA:D2:1F:7A:0D:12:1C:5C:4E:36:85:E2:46:45:38:2B:F8:F7"}}},"request":{"raw":"GET /_nuxt/BqzaD3Pl.js HTTP/1.1\r\nHost: www.gwdt26x.life\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nCookie: __ddg8_=Qkoq0awwpSp4tPq7; __ddg10_=1759814029; __ddg9_=82.148.169.64; __ddg1_=RyFytlPEjbdkx9tyBP6H; i18n_redirected=en; userVersion=45.10.240.51; userBrowser=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0; _gcl_au=1.1.1526880181.1759814027; _ga_VRDLWS0SHC=GS2.1.s1759814027$o1$g1$t1759814028$j59$l0$h0; _ga=GA1.1.2086443664.1759814027; ajs_anonymous_id=fa2cd691-7554-47f2-9207-f4a67ee96961; AMP_15377f970f=JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjJhODI2ZDY1NC1kNzcxLTQyZWItYTk1Ny0xNmViMDg4YzZjMzglMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzU5ODE0MDI3ODQ4JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc1OTgxNDAyODMxMiUyQyUyMmxhc3RFdmVudElkJTIyJTNBMSUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMCU3RA==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: ddos-guard\r\nset-cookie: __ddg8_=x7EAwMoWb3OFXayQ; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg10_=1759814029; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\n__ddg9_=82.148.169.64; Domain=.gwdt26x.life; Path=/; Expires=Tue, 07-Oct-2025 05:33:49 GMT\r\ncontent-security-policy: upgrade-insecure-requests;\r\ndate: Tue, 07 Oct 2025 05:13:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 03 Oct 2025 07:34:57 GMT\r\netag: W/\"68df7ca1-1fe\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nage: 3\r\nddg-cache-status: HIT,MISS\r\ncontent-length: 342\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"DDoS-Guard","description":"DDoS-Guard is a Russian Internet infrastructure company which provides DDoS protection, content delivery network services, and web hosting services.","website":"https://ddos-guard.net","common_platform_enumeration":"","icon":"DDoS-Guard.svg","categories":["Security"]}],"data":{"size":510,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (509)","md5":"48659d4240295b9e64caab349266ed60","sha1":"72d8336e72ca76db1563fac1c496ded6ff65ae3c","sha256":"127ea5b1a4a77e85a4a100e7f9301b32e1e607a2c9b3b9f714def75e098b0ab1","sha512":"4ad1491e8175e0c642a3032062dd6e2ebb251ba4c1b94e4192e4fa50688cfbf6b748d45c0433bf36af924f90c65f4bb9e35267929b16482411800a5346042745","ssdeep":"","tlshash":"e8f0c92eb1dab43543ccd8c441380c006861ad602c0e218ed19b9f13b1d07a3708bd30","first_seen":"2025-09-04T16:11:26.386239Z","last_seen":"2026-04-12T00:18:50.830483Z","times_seen":46,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-07","alert":"Sinkholed","trigger":"www.gwdt26x.life","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/recaptcha/releases/Jv8jlA-BQE5JD6rA-h_iqNH2/recaptcha__en.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.67","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.gwdt26x.life/","date":"2025-10-07T05:13:47.799Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:36:13 GMT","end":"Mon, 08 Dec 2025 08:36:12 GMT"},"fingerprint":{"sha1":"F3:C7:68:20:2E:52:7F:61:4B:43:46:72:CB:A9:29:91:40:A0:5A:96","sha256":"1A:0B:E2:45:70:7A:DB:88:E8:4C:4E:DF:ED:F5:08:2F:2B:2A:CA:33:09:72:DC:80:8B:D2:7B:C6:48:3D:CA:D1"}}},"request":{"raw":"GET /recaptcha/releases/Jv8jlA-BQE5JD6rA-h_iqNH2/recaptcha__en.js HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.gwdt26x.life\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gwdt26x.life/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"recaptcha-scs\"\r\nreport-to: {\"group\":\"recaptcha-scs\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/recaptcha-scs\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 349597\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 07 Oct 2025 00:50:41 GMT\r\nexpires: Wed, 07 Oct 2026 00:50:41 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 29 Sep 2025 12:04:53 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nage: 15786\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":820265,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (611)","md5":"79d46b9e2a42785f28f64082a61eabbf","sha1":"c1b66a198b40bcd1f6cce34704173f997ecd8608","sha256":"6159c42218db471f012088abd52e60fe39e5c1dcf2981ff7d80f38d8bd36a690","sha512":"820943d8b4d684933ce756b9d59c499147aae8336a811b042d8ee8bf035ecb20be12ff815d0ba4a8676c815b9e6bf2d687591d434bedfbbf07e56dae34f39c49","ssdeep":"12288:iF/YdSVcst0yzYy0Vqqog/cT6eKb54lptHAgR1BoOdy3aWKi:QQozYJog/Y6fV4lbpR1BRdyKK","tlshash":"b70529c870257a624332b5f6707b209da36e5966d45c095d70a6c4f03fb098db0baebf","first_seen":"2025-10-01T09:12:21.067891Z","last_seen":"2026-06-02T23:59:04.965062Z","times_seen":7915,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":48,"dns":1,"connect":8,"send":0,"wait":9,"receive":33,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}