{"report_id":"e3a2e9b9-2601-477f-aa32-68563a1e3d6d","version":6,"status":"done","tags":[],"date":"2026-01-04T23:54:24Z","url":{"schema":"http","addr":"doyr-drop.top","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"172.67.179.219","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"doyr-drop.top/","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"title":"DOYR","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"doyr-drop.top","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"172.67.179.219","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-08T23:54:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"doyr-drop.top","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-06","domain_rank":0,"first_seen":"2026-01-04T23:54:25.452662Z","last_seen":"2026-01-04T23:54:25.452662Z","alert_count":26,"request_count":13,"received_data":5303996,"sent_data":5671,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"doyr-drop.top/","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"26cd9e4bdf775d3b6bfc3ee88e69ae57","sha1":"278ef3a50feccda637e644dfb08cc05b7c58fb19","sha256":"d05116299e2e64684a2f1c1b7b1c685a88a280c722105bf0b72652ebe6e2db48","sha512":"ab4cece7077db76a25657357bed236e0a6554980d4d9d1b2bf984ed018d90740e38a701bee50c6c7f4e02f04d4ac0dc2a41268494de50e8fc8fbb1c03f88b100","ssdeep":"","tlshash":"27f0f65d27f322b9627f2152d2038489be50506270dad849741c91894fd6d6460de69a","size":580,"data":"","first_seen":"2025-03-31T17:31:43.383192Z","last_seen":"2026-04-16T15:11:04.446441Z","times_seen":143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/qunit-2.19.4.js","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c1e64395dfa87b7f14797a5d37bc68f1","sha1":"11c70694f9142bb7c9be5f0278866a7168bd1089","sha256":"8f6ce9af5e43f070c8bb525b56e875bf2ec93e34c06a9ed3e6f99a3613d6496b","sha512":"a95791b86b7e40566e64361db9b3e3fbeab7a5ce134a129ffaa3293d7e3ffd10f52dfb14a87e2f4669db5d38e2d6365feb159a93e6bd692a46b68216440ad1a1","ssdeep":"768:dWuYcgGcYD2G7ZGforEI82MPlCgNasSdnmxWuatoLJ8acwNcVTrS6O0chUmoyeb:8bW2G7ZGwrEWcUaa/M5a2jNKR","tlshash":"7d530ce85816d0e44d61a0edc477e909e8a40e5bcd6ef163aa3ceec27c4df1685431bb","size":62396,"data":"","first_seen":"2026-01-04T23:54:31.841658Z","last_seen":"2026-01-04T23:54:31.841658Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/3082ad63-2851-4490-bebe-cd673c5da37f","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"7df73988252e4e56e97ba60a379b1adb","sha1":"71fcb419a05752a6816ec8cb8d6ff66f2b286575","sha256":"795b58fa3e79ac5f0fe3f40fd1a8780febc568757a02fb88cece17317ec0a0d3","sha512":"76bbb9908159d4a89749d84c7cfc019cebaecb2a738e68d09f3e7194cd362e8991548472274377a2b829abdeccdd6a077443dca3c4c9f205ccf78d4a3568702e","ssdeep":"768:FVX6Xl2NCM1idz41CAr7cC2Iq5a87XZUXfl2rsi14UcCs+Wl4:FVLCl","tlshash":"6ca333131cbe346b048f4b63f5295e47af5ffa43da16624cb2bc26852fb7d56c982204","size":107243,"data":"","first_seen":"2025-12-16T18:55:46.047375Z","last_seen":"2026-07-18T23:39:45.24889Z","times_seen":465,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/script.js","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3d1fde210481b064bc17743687f189d5","sha1":"2a572c4bdebffbc9cb448d322ff4e2e1d776bc4f","sha256":"0b5f410bef76b5e2da3b626e4b5d401d1bda83e494b3db88a2cdbbf8fe1490c0","sha512":"daa92387029abf4314afc7315939484e7495c1fcb4702db20a64f0b4d1b379f4460b8c41ca11ac4c4634f32937631a5ecd5186e424b5e9dbf825a810ec23f5b3","ssdeep":"","tlshash":"4e511f3b0a7b003600bf93a3f29e4b057a75006b324557063abe8a481fe4c7569d2db2","size":2491,"data":"","first_seen":"2025-10-09T17:38:10.054195Z","last_seen":"2026-01-04T23:54:31.833739Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/d404b719-697e-440d-a9a4-556a3609af7a","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec26a722169cb2cef03353fcf8dd144a","sha1":"6eec6673abcde3d29547796a38361256d9efde1c","sha256":"01861fcd47bc63bb7be76c480bad4c6cc987c8996ab0e023a4e692b68c94b05c","sha512":"c885e5d94bd96fa4a573524356e0ca7398b1489f5a39fc1120cf7f4e469950630ad3e9f48dd0392acd36da390c27a4be1e81da943d1d9ecd48890d1691e416cf","ssdeep":"6144:Ufg7z90bnvLZqnWTI9esVTMuyEvtzXNglxQP92L:VzBe6kEdOxQoL","tlshash":"bf740980b261b07247da24e10477540af339e96c744a40acf6a8d8fb7dbd589957ff38","size":357754,"data":"","first_seen":"2025-07-12T22:38:09.13306Z","last_seen":"2026-06-28T16:47:47.454007Z","times_seen":5087,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"doyr-drop.top/2.png","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /2.png HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 63125\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-f695\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hkgun2Mi3Y10Swi0OTLHIljltqM5lDJQibadnkAbRD8fV4%2FJYpOQ2ASI%2FDk4oSLI4BPnclcArVHpNsVj7OCG%2BPzaY8Xve9DhQ%2BejiQA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4e9c50883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":63125,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"0ae617a690d24e9f3159290cfa54a9eb","sha1":"5cf5def6d0820358caeb5e7097a1675f3940425d","sha256":"6fb8b01e87fe5a940a97b52dade11773a24dde63d9de531df83dc0d97839648f","sha512":"a49c7c5668a34d052480d1d88b7d8967d73f0031e114fb80c0ebfc46a17c87e419f297392277540672de07d07198323810822a7bda3361bc8cf0a69acd87227a","ssdeep":"1536:1yMuReTU1khFh3jPfegB13SpOW4mIHuPoE:1yl/1khFh3zegf3lW1yaoE","tlshash":"f9530146dbd574a6058f6f90d2f68da4ac0b4f0eccd0ca8c9672c19b18b0bb4f599a13","first_seen":"2026-01-04T23:54:31.831366Z","last_seen":"2026-01-04T23:54:31.831366Z","times_seen":1,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/6.png","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /6.png HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 68091\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-109fb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BAodws0I1WFlY4TP9xMOteZTa9KDYY4aGmG0xxpBccaHJ319Ig9nrugG45jg1w9qgDJGis15Za4pn9IbndsE5ff0HD9MZeQfW%2F22oI8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4e9c80883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68091,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"84eadf04a6f92654aede1367f2d64338","sha1":"0eefc4a3280892e94b800404e53b6dcbc618d0e1","sha256":"beea21b1abe098486418d68a7b510aa5092f53ff1466fe839b7757b78c1f9b3a","sha512":"a64f2f6961cdae05a084423855b48b17679af6324476401471520b34efdd33bc423277bf27a9411228eed9641d82671916a3a22a7f68d708f9224383b1be2f0c","ssdeep":"1536:1yMP6ScpcMmVUE1slWQfMiE+7FC4JmDPkVKEsYTyGwDFVW+bTQy6pffzs3/:1ybjAVUa9uMiEKLJm5EJTyGwJVDXB2Xu","tlshash":"cc630242df92df4767fa33b146396a640e049409d4f681c0b76aa6dcf89836b4ce3dc6","first_seen":"2026-01-04T23:54:31.83266Z","last_seen":"2026-01-04T23:54:31.83266Z","times_seen":1,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/script.js","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.402Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /script.js HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: W/\"69349a14-9bb\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BvvO00uSn%2F5RKmREw2SLHyaVwwmEHaA2yXRJeEaUgbqlfjLVOYL7%2BbroWoLb%2FdUaKQr6vlT98dauEe8U6tn0mFEJZhuP5UaqKV%2FkOgg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4e9d40883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2491,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"3d1fde210481b064bc17743687f189d5","sha1":"2a572c4bdebffbc9cb448d322ff4e2e1d776bc4f","sha256":"0b5f410bef76b5e2da3b626e4b5d401d1bda83e494b3db88a2cdbbf8fe1490c0","sha512":"daa92387029abf4314afc7315939484e7495c1fcb4702db20a64f0b4d1b379f4460b8c41ca11ac4c4634f32937631a5ecd5186e424b5e9dbf825a810ec23f5b3","ssdeep":"","tlshash":"4e511f3b0a7b003600bf93a3f29e4b057a75006b324557063abe8a481fe4c7569d2db2","first_seen":"2025-10-09T17:38:10.054195Z","last_seen":"2026-01-04T23:54:31.833739Z","times_seen":2,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/secureproxy?e=jscdn/getFile","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"POST /secureproxy?e=jscdn/getFile HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://doyr-drop.top/\r\nContent-Type: application/json\r\nContent-Length: 37\r\nOrigin: https://doyr-drop.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":37,"data":"{\"permit_key\":\"88u1e7u6zlklgp6267tq\"}"}},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:03 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\ncast-mode: default\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding, origin, access-control-request-method, access-control-request-headers\r\nx-content-type-options: nosniff, nosniff\r\nx-frame-options: DENY, SAMEORIGIN\r\nx-xss-protection: 1; mode=block, 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-security-policy: default-src 'self'\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UnttVZ%2BwRAikNz3Ph1vc%2FR8OZOqPFPWe4%2BjaMbrrs7x1pDYshfBPk9PJJVMGED1OP3Rm28bUGaXq625PFFf%2FJlQVmK2klA%2BxfZdQPf51QQ2AdA%3D%3D\"}]}\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\npriority: u=4,i=?0\r\ncf-ray: 9b8ea8a87f560883-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4594981,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"081ea659ec0d14df84351668e47e3441","sha1":"6198a7bb7fe1e65970fafd6928736c4dc92650de","sha256":"7aab6881bf7f259064775334df5c21a3b9f181d777fe0c6d2e36aab763bc097e","sha512":"38d4d0e248ffae557131451a118269905f25f0f3378efffd4a7be707d99f4386554fdec9271177e7e9cc36cead7fedf7db2e62d69229f3174e4351d34f243725","ssdeep":"24576:zMcNkDZUv1MYl8jZqtiwTqY/EV4LNFh5zrOFWSXMQ/Bd4ZnPXY:zfkDQuZcTp2GrV8xSvY","tlshash":"8c2522dba052f5463465807fb3e55ab97eab80cc7fc9067375dad488b0ce0b589e41c2","first_seen":"2026-01-04T23:54:31.835085Z","last_seen":"2026-01-04T23:54:31.835085Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1236,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":598,"receive":638,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-04T23:54:01.662Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NnaBojg0W2UAcWrM7x%2FqWKYd5NpTBwTHyBAKuEaFF3JlDJAsN21UKY49C6GG7zq5EtY4OHC9WZ%2BKhLi2Uo2O2pmOxtSFkwUjByqdjhQ%3D\"}]}\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: 9b8ea8a26b56c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4685,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"3c90b0973a2f620b1d777ca7adf1c8c1","sha1":"a555694582f9140d67ac07b9bd93c416d5eaad1a","sha256":"02ff96e3b02a901ac8fec53db3730c79250bea44edabfb0f12ecfb6e68d90786","sha512":"6a46a5290054db358c9ac2b9e55eb6415e9f10e39b8d32bb8e109b9b396dff172fc9a393e12335f23676b42d58c37fa93c4047e426ebbf4f553aae2475929bb3","ssdeep":"48:TXXbPchaipe4iM6odchzDv4gMu3CncJqb1zf11GYTGgAN:T7chaipwodcBDgg/CcJI1zf1saGgk","tlshash":"7aa10f342af21167508381c1aa678b5e7fc0d643ca4b4845b2fc07d69fd2d8bc89b51d","first_seen":"2026-01-04T23:54:31.836101Z","last_seen":"2026-01-04T23:54:31.836101Z","times_seen":1,"resource_available":false,"data":null}},"time_used":893,"timings":{"blocked":320,"dns":302,"connect":1,"send":0,"wait":253,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/mainn2.png","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /mainn2.png HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 59664\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-e910\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DGix72%2FRFJpUdDNr6DX9AXJ%2Fhjr%2BYgbhuPPiZwnBslqLlAZjmmcSUjv0AAnddCVOIV%2BUn8BLFwWcdGcHS6xZWBl2XLtJ5GgUf1bpbzo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4d9bc0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":59664,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"2cc717b3cbd6dbad8754f5ce610073bb","sha1":"b14ab650cc33ec7abaac642ef630655c5738d193","sha256":"e17c0187148afa3bf49859ed470b532b8c6466db95c2a3f893e2e2ac53c30567","sha512":"d8ba594004ef29adf78c30e4b327205921805f5b143be2f9f24a4741c51d4a892358aa0b818daf232323588653df6fd7578e0af91c78d69b0d06f3d83cb0c2fb","ssdeep":"1536:1LMnpRD6VXJUp15hmzZwEMN3mKLStZ78LZG:1L2AVXJ2Hh/fQy8","tlshash":"ee43f104ed483e9ee02973f1c736316ca40f576dd86a21e879b0d88c2cb9341f99c9b6","first_seen":"2026-01-04T23:54:31.83705Z","last_seen":"2026-01-04T23:54:31.83705Z","times_seen":1,"resource_available":false,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":280,"receive":88,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/5.jpg","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /5.jpg HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7339\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-1cab\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iDbXGvG9yoXhz5YUv7zNDZ71GeiKslEHwXT1Y5HHwss4%2F6IA7y3U1%2FA9apx67Zdq7KOy12DT8gyqr5bSPajUrZPUHSImU%2FKOnwBBAAA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4d9be0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7339,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"Compressed by jpeg-recompress\", progressive, precision 8, 512x512, components 3","md5":"087f5ebc65bb6e0df53a2737aa394fbe","sha1":"63818bc096385d60ab53db9199ed372a8474b7f3","sha256":"41c94c589da1a612909c46ea278b69d7e65c816ba63ea51c62eb6aab5ff848df","sha512":"1d90ff52b1b35178acb400a92ff3bf123a791f1cf5c4e5c13105553f44e2c5ac2c6d634cc13225e1f009c4ce606849018b41631ee7bc08541d1fd08d9a72d7c0","ssdeep":"192:G+ZAvjxPo0aMScjE39elxKPEk7u+7f9ot2KQwcH:Gnpo0aMSB3m/iu+L9BWw","tlshash":"98e17d16931ae1e1fab5277b113303baa8ee4de740f2c24d70050e085a79cfa75c0ee9","first_seen":"2026-01-04T23:54:31.837986Z","last_seen":"2026-01-04T23:54:31.837986Z","times_seen":1,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/mainn.png","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /mainn.png HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 86226\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-150d2\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=A2uhZHyKgbd%2FQBd9VyfYjkmXLOpQKEhKkqaeTjtewqGTksnpJYXWLjdH7NIUbR64TTJfRFhdjlSvdnQlluVPWJZGtvjv96iZNu05F5w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4e9c90883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86226,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"c5070c0bb530d3eb73ae1ee3e2d3e021","sha1":"c34751de319f5549beecb05ec8e0b57bec6bd990","sha256":"8ec616e84af8f076f2382ff93c0c4f87281de8d7c1ae350a636dad82d17787fc","sha512":"df684a23798cd7df2bdbf461b2f09bbd3d2127909544d2d4be864d2e4458ba5528adf2d42ba7602048799eced112c2ef3a5966f6211f21df8b975100fc4ee0a3","ssdeep":"1536:1yMa0O5CdcjV6Tsy6gADLWW3jMsQtxmFBlwwA0l7MEer4XTax94HXCu:1yZH5Cdc56BhA/3jMzxmblF7aUjaHgCu","tlshash":"ac83024697a864f0db4dbcd5b8635541cdb2b41ed09fe9646c0d023fbca53e223b6262","first_seen":"2026-01-04T23:54:31.839013Z","last_seen":"2026-01-04T23:54:31.839013Z","times_seen":1,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":272,"receive":103,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/mainn1.png","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /mainn1.png HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 290874\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-4703a\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FOl3b0wna01CXaeHT%2Byhcgx2xpEK0LS6Xs2Iu6iTIeYK8UYWn7QKoajASy77poRzTdxJQtYT5xx8Qkg9FawfPdnc1Oc3mIyGjFTj46M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4e9cf0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":290874,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1080 x 1080, 8-bit/color RGB, non-interlaced","md5":"2a11e5917743dac83d13db81d09ca723","sha1":"247e86465856512b271b93e9975f52f240718d8f","sha256":"3b152bb1dca410f791f736101bf8d7402717868a864dbc9d64c8f6935c1a0fdb","sha512":"b7e39369a9592876d7eb396375233d7c6a38d00c1f35e283df2ab3a4a0195500639044f86656d656f765b6418092e489eec2828cbf7535179b74d4ad455229d2","ssdeep":"6144:I+DmtWFKO2pC6w1tqcJvgYHjLYQi45ReK3QVdstZjH8Spw9i9O:nmtWAC6w1tq9YDL3uK3CeczgO","tlshash":"195422a789aae506da52c8610bd7475997f7384b03ea4335f69ef4ac0446efc09078cf","first_seen":"2026-01-04T23:54:31.839892Z","last_seen":"2026-01-04T23:54:31.839892Z","times_seen":1,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":265,"receive":191,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/5.jpg","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /5.jpg HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7339\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-1cab\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\nage: 0\r\ncache-control: max-age=2592000\r\ncf-cache-status: HIT\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W54S7goCbQSIyqNu1wqEhQNyV4TzysI24apvt2lOzzvZ7Cz2xs%2FlouYJG%2FDs1S1X8uajG9yE5IyMAkFmRxvwjExUXnF9XGYyQ9mrKVs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a83ef80883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7339,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"Compressed by jpeg-recompress\", progressive, precision 8, 512x512, components 3","md5":"087f5ebc65bb6e0df53a2737aa394fbe","sha1":"63818bc096385d60ab53db9199ed372a8474b7f3","sha256":"41c94c589da1a612909c46ea278b69d7e65c816ba63ea51c62eb6aab5ff848df","sha512":"1d90ff52b1b35178acb400a92ff3bf123a791f1cf5c4e5c13105553f44e2c5ac2c6d634cc13225e1f009c4ce606849018b41631ee7bc08541d1fd08d9a72d7c0","ssdeep":"192:G+ZAvjxPo0aMScjE39elxKPEk7u+7f9ot2KQwcH:Gnpo0aMSB3m/iu+L9BWw","tlshash":"98e17d16931ae1e1fab5277b113303baa8ee4de740f2c24d70050e085a79cfa75c0ee9","first_seen":"2026-01-04T23:54:31.837986Z","last_seen":"2026-01-04T23:54:31.837986Z","times_seen":1,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/styles.css","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /styles.css HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: W/\"69349a14-1782\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yyKlRRp02l7L8tSC0mEXwwjbQdFW%2B%2FRACiagdu8uAyZtzPwaFlvn0fFsjJv7SsyrKi0tyvVQs50MWVM09DKEMj2N%2BOWfDPjelIwDkjE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4d9ba0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6018,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"7103f84477503224a06b499df35a1503","sha1":"f7422be67867f871951235d376b277d84f877893","sha256":"db9ff02bffc6de2ecb75d3010d0969346f04699e478d8c021e56651153524a0c","sha512":"eada53c55b9d1e46fccb5e222709ef3596070b14a572f30431c53a4922f29b803aa24b939cbd89c825187d908a25972f2a15dec0feae6c5928aa3a840da98f14","ssdeep":"96:ejH+FjFP9H3QkJbOwzqXd/wfEwmsLY9QWeTmoleT1urAyRAzETs01DI:8H+Fj99XQMbO5Xd/wfEFsLY9QLTmoleF","tlshash":"b2c100411b630555a42bd9586ffb9b49635c9043890ecd7e7bcd52848fc92bcb1a1f8c","first_seen":"2025-10-09T17:38:10.06829Z","last_seen":"2026-01-04T23:54:31.84074Z","times_seen":2,"resource_available":false,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/qunit-2.19.4.js","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /qunit-2.19.4.js HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: W/\"69349a14-f3bc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MXH4CbBGisDjEtNzXQhRA8XA90JcLH%2FPgluAkksmBxRIlx8Ux3Ur7D9Gr1yKUZ%2FtsKZ8bAetyS9iZsUaerRQtFI2nllTWzdjBnUCg9w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4d9bb0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62396,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (62396), with no line terminators","md5":"c1e64395dfa87b7f14797a5d37bc68f1","sha1":"11c70694f9142bb7c9be5f0278866a7168bd1089","sha256":"8f6ce9af5e43f070c8bb525b56e875bf2ec93e34c06a9ed3e6f99a3613d6496b","sha512":"a95791b86b7e40566e64361db9b3e3fbeab7a5ce134a129ffaa3293d7e3ffd10f52dfb14a87e2f4669db5d38e2d6365feb159a93e6bd692a46b68216440ad1a1","ssdeep":"768:dWuYcgGcYD2G7ZGforEI82MPlCgNasSdnmxWuatoLJ8acwNcVTrS6O0chUmoyeb:8bW2G7ZGwrEWcUaa/M5a2jNKR","tlshash":"7d530ce85816d0e44d61a0edc477e909e8a40e5bcd6ef163aa3ceec27c4df1685431bb","first_seen":"2026-01-04T23:54:31.841658Z","last_seen":"2026-01-04T23:54:31.841658Z","times_seen":1,"resource_available":true,"data":null}},"time_used":324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"doyr-drop.top/1.png","fqdn":"doyr-drop.top","domain":"doyr-drop.top","tld":"top"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://doyr-drop.top/","date":"2026-01-04T23:54:02.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"doyr-drop.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 06 Dec 2025 20:08:52 GMT","end":"Fri, 06 Mar 2026 21:07:37 GMT"},"fingerprint":{"sha1":"3F:7D:11:FB:67:4E:C5:45:B8:CE:8F:6B:F9:BC:A5:AC:0C:89:9B:48","sha256":"37:8C:31:E1:BD:AA:07:F6:02:5E:C8:A3:7C:FB:5E:98:29:BB:7E:AD:AB:0D:01:B1:1E:D0:49:90:E4:FA:A1:6F"}}},"request":{"raw":"GET /1.png HTTP/1.1\r\nHost: doyr-drop.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://doyr-drop.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 04 Jan 2026 23:54:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 38856\r\nserver: cloudflare\r\ncast-mode: default\r\nlast-modified: Sat, 06 Dec 2025 21:03:16 GMT\r\netag: \"69349a14-97c8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=2592000\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UCwzHDDzgdP1PZ6JdMDjg3OEH9CuIX96o9s9QugtXMzlUeGigpTk1VBt%2BSb2AtqV%2FcXZVPrJtr%2ByonBHBamC2r8367E9IUEwy3sKjUQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9b8ea8a4e9c20883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38856,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced","md5":"aaa48732b9935ce9f578d7b9d4771885","sha1":"773d6b1a846ebcd68df41116d902ed57e9157d83","sha256":"2e844d1954e5ba8eae01009471f78b53757954a5c64ba464059346f7ddbfab9d","sha512":"49e5a803156e54220d04ebecd18cbdf7c4dbdb297226ed9b254df58e54fa81937a2139ca835aab511f379f96527ada37a4f9198050438d54b7ca5392874cb87f","ssdeep":"768:1QwKMBBSJhJZjW8zqVtgqOO+qnfYmJAq3vLmEH5fYkh8AJ7Gg:1yMBBshJ1W8zutVOhqnQTPEHZb3","tlshash":"b303d1402e5cde0ab38157f367a9e319eabaee1fd854527d856017cc1ae81e0f4c2d46","first_seen":"2026-01-04T23:54:31.842795Z","last_seen":"2026-01-04T23:54:31.842795Z","times_seen":1,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":56,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-04","alert":"Sinkholed","trigger":"doyr-drop.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}