ScanMalware.com

Statistics

What ScanMalware saw in the last 7 days: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
40,505
31,842 distinct sites
Malicious scans
13,826
34.1% of public scans
Malicious sites
11,730
distinct hostnames

Scans and malicious scans

All public scans per 6 hours (UTC)

MaliciousOther scans
Hover a column for details · peak 2,270
11-03 06:00 UTC11-10 06:00 UTC
Show as table
PeriodScansMalicious
11-03 06:00 UTC37870
11-03 12:00 UTC1,718540
11-03 18:00 UTC2,270915
11-04 00:00 UTC2,005637
11-04 06:00 UTC2,154568
11-04 12:00 UTC1,931603
11-04 18:00 UTC1,693360
11-05 00:00 UTC1,872616
11-05 06:00 UTC1,942466
11-05 12:00 UTC1,824713
11-05 18:00 UTC1,446429
11-06 00:00 UTC1,408494
11-06 06:00 UTC1,423392
11-06 12:00 UTC1,488564
11-06 18:00 UTC1,306337
11-07 00:00 UTC1,254395
11-07 06:00 UTC1,171320
11-07 12:00 UTC1,241498
11-07 18:00 UTC1,075414
11-08 00:00 UTC1,095514
11-08 06:00 UTC1,029369
11-08 12:00 UTC1,401611
11-08 18:00 UTC1,122474
11-09 00:00 UTC1,127484
11-09 06:00 UTC1,086421
11-09 12:00 UTC1,136480
11-09 18:00 UTC1,022403
11-10 00:00 UTC1,081428
11-10 06:00 UTC807311

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸199.36.158.100CDNAS54113 Fastly, Inc.1,628
🇺🇸188.114.97.3CDNAS13335 Cloudflare, Inc.768
🇺🇸188.114.96.3CDNAS13335 Cloudflare, Inc.743
🇺🇸104.18.54.45CDNAS13335 Cloudflare, Inc.500
🇺🇸104.18.50.34CDNAS13335 Cloudflare, Inc.465
🇺🇸172.238.172.122AS63949 Akamai Connected Cloud156
🇺🇸172.236.104.157AS63949 Akamai Connected Cloud134
🇺🇸172.236.104.43AS63949 Akamai Connected Cloud123
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.96
🇺🇸216.198.79.131CDNAS16509 Amazon.com, Inc.87
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.85
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.85
🇺🇸216.198.79.195CDNAS16509 Amazon.com, Inc.84
🇺🇸64.29.17.131CDNAS16509 Amazon.com, Inc.84
🇺🇸64.29.17.3CDNAS16509 Amazon.com, Inc.79

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    4,078
  2. AS54113 Fastly, Inc.
    1,644
  3. AS16509 Amazon.com, Inc.
    760
  4. AS54600 PEG TECH INC
    459
  5. AS63949 Akamai Connected Cloud
    405
  6. AS398823 PEG TECH INC
    230
  7. AS138415 Yancy Limited
    190
  8. AS45090 Shenzhen Tencent Computer Systems Company Limited
    181
  9. AS139057 Edgenext Legend Dynasty Pte. Ltd.
    121
  10. AS139341 ACE
    119
  11. AS132203 Tencent Building, Kejizhongyi Avenue
    118
  12. AS31898 Oracle Corporation
    112
  13. AS142286 LUOGELANG (FRANCE) LIMITED
    109
  14. AS36352 HostPapa
    97
  15. AS37963 Hangzhou Alibaba Advertising Co.,Ltd.
    86

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    105
  2. cr-web.workers.dev
    18
  3. gdmaoka.com
    17
  4. iceiy.com
    14
  5. edgeone.app
    10
  6. bolt.host
    7
  7. hstn.me
    7
  8. tw1.ru
    6
  9. weebly.com
    6
  10. b-cdn.net
    5
  11. gitbook.io
    5
  12. rf.gd
    5
  13. s2499621.workers.dev
    5
  14. 146slot.org
    4
  15. 988boss.org
    4

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    1,571
  2. r2.dev
    958
  3. web.app
    920
  4. firebaseapp.com
    804
  5. vercel.app
    436
  6. workers.dev
    168
  7. netlify.app
    142
  8. replit.app
    23
  9. onrender.com
    16
  10. typedream.app
    11
  11. wixstudio.com
    11
  12. blogspot.com
    10
  13. framer.app
    7
  14. github.io
    7
  15. plesk.page
    5

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    4,401
  2. Other
    3,161
  3. Malware Distribution
    1,748
  4. Brand Impersonation
    1,735
  5. Investment/Crypto Scam
    148
  6. Illegal Gambling
    147
  7. Survey/Reward Scam
    64
  8. Fake Shopping
    45
  9. SEO Spam
    24
  10. Advance Fee Fraud
    22
  11. Tech Support Scam
    16
  12. Adware/PUP
    10

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    2,809
  2. .com
    2,263
  3. .app
    1,582
  4. .top
    579
  5. .org
    146
  6. .net
    122
  7. .buzz
    86
  8. .shop
    77
  9. .xyz
    75
  10. .fr
    65
  11. .info
    49
  12. .de
    42
  13. .cfd
    40
  14. .br
    38
  15. .cc
    38

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States8,5632,159
🇭🇰 Hong Kong743723
🇨🇳 China417417
🇩🇪 Germany373201
🇸🇬 Singapore304292
🇯🇵 Japan174159
🇫🇷 France103103
🇸🇨 Seychelles102100
🇳🇱 Netherlands9478
🇬🇧 United Kingdom8176
🇵🇦 Panama7777
🇦🇺 Australia4946
🇷🇺 Russia4947
🇧🇷 Brazil4141
🇰🇷 South Korea4036

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇺🇸 United States
    2,159
  2. 🇭🇰 Hong Kong
    723
  3. 🇨🇳 China
    417
  4. 🇸🇬 Singapore
    292
  5. 🇩🇪 Germany
    201
  6. 🇯🇵 Japan
    159
  7. 🇫🇷 France
    103
  8. 🇸🇨 Seychelles
    100
  9. 🇳🇱 Netherlands
    78
  10. 🇵🇦 Panama
    77
  11. 🇬🇧 United Kingdom
    76
  12. 🇷🇺 Russia
    47
  13. 🇦🇺 Australia
    46
  14. 🇧🇷 Brazil
    41
  15. 🇰🇷 South Korea
    36

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 3,084 of 5,023 such sites.

  1. 🇺🇸 Los Angeles · United States
    610
  2. 🇺🇸 Chicago · United States
    385
  3. 🇭🇰 Hong Kong · Hong Kong
    248
  4. 🇺🇸 San Jose · United States
    227
  5. 🇯🇵 Tokyo · Japan
    120
  6. 🇩🇪 Frankfurt am Main · Germany
    119
  7. 🇨🇳 Shanghai · China
    105
  8. 🇸🇬 Singapore · Singapore
    104
  9. 🇺🇸 Ashburn · United States
    63
  10. 🇨🇳 Beijing · China
    62
  11. 🇺🇸 Phoenix · United States
    62
  12. 🇨🇳 Guangzhou · China
    61
  13. 🇺🇸 Buffalo · United States
    47
  14. 🇺🇸 Santa Clara · United States
    46
  15. 🇳🇱 Amsterdam · Netherlands
    37

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇺🇸 United States
  2. 2.🇬🇧 United Kingdom
  3. 3.🇩🇪 Germany
  4. 4.🇱🇻 Latvia
  5. 5.🇸🇪 Sweden
  6. 6.🇨🇭 Switzerland
  7. 7.🇷🇺 Russia
  8. 8.🇨🇦 Canada
  9. 9.🇵🇰 Pakistan
  10. 10.🇧🇷 Brazil
  11. 11.🇳🇱 Netherlands
  12. 12.🇮🇳 India
  13. 13.🇹🇳 Tunisia
  14. 14.🇱🇹 Lithuania
  15. 15.🇫🇷 France
  16. 16.🇪🇸 Spain
  17. 17.🇨🇳 China
  18. 18.🇪🇬 Egypt
  19. 19.🇹🇭 Thailand
  20. 20.🇨🇾 Cyprus

Site traffic

Counted from 2026-11-03 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.padisahbet.yeni-koruma.icuIndex of /
  2. 2.m579c95.topLatest @ Sites
  3. 3.kcfmfk.ltd
  4. 4.msftportallogin.comEnter your code
  5. 5.bankhapoalim-cibc.phRedirecting...
  6. 6.shekan.ms3sdms3sd.workers.devInternet Speed Test - Measure Network Performance | Cloudflare
  7. 7.spark.online-access.info
  8. 8.delinea.arWeTransfer
  9. 9.hazel-finch-9be5-2e27e655.pages.devCloudflare Speed Test について | Cloudflare
  10. 10.b.woneli7366.workers.devInternet Speed Test - Measure Network Performance | Cloudflare
  11. 11.spam01.tekken.sespam01.tekken.se - Parked
  12. 12.masterroutegroup.comPrivacy Policy · MASTER ROUTE GROUP
  13. 13.plangku.comSign in - Google Accounts
  14. 14.gentle-ridge-ad08-4313e8f4.pages.devWebsite Access Blocked
  15. 15.202608.urldance.comLatest @ Sites

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇫🇷 France
  3. 3.🇩🇪 Germany
  4. 4.🇬🇧 United Kingdom
  5. 5.🇧🇷 Brazil
  6. 6.🇸🇬 Singapore
  7. 7.🇪🇸 Spain
  8. 8.🇨🇳 China
  9. 9.🇨🇦 Canada
  10. 10.🇮🇳 India
  11. 11.🇮🇹 Italy
  12. 12.🇮🇶 Iraq
  13. 13.🇵🇹 Portugal
  14. 14.🇹🇷 Turkey
  15. 15.🇮🇩 Indonesia
  16. 16.🇳🇱 Netherlands
  17. 17.🇯🇵 Japan
  18. 18.🇻🇳 Vietnam
  19. 19.🇮🇱 Israel
  20. 20.🇲🇽 Mexico

Most requested registered domains via the API

Lookups grouped by registered domain

  1. kpmg.com
    663,583
  2. bmwgroup.com
    219,535
  3. bmw.com
    132,809
  4. pvp.net
    103,127
  5. t-mobile.com
    74,730
  6. leagueoflegends.com
    68,195
  7. kpmg.com.au
    60,694
  8. blackstone.com
    47,267
  9. kpmg.de
    44,239
  10. wjunction.com
    29,349
  11. kpmg.fr
    27,938
  12. snowflake.com
    27,361
  13. 91aql.com
    25,583
  14. usiminas.com
    24,462
  15. eldoradobrasil.com.br
    23,976

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/search/smql
    23,324,544
  2. /api/v1/hosts/{host}
    23,182,614
  3. /api/v1/ct/dns/{host}
    22,875,986
  4. /api/v1/rdap/{id}
    169,629
  5. /api/v1/domain/history/{host}
    154,407
  6. /api/v1/domain/stats/{host}
    144,531
  7. /api/v1/search
    120,432
  8. /api/v1/tls/{id}
    114,012
  9. /api/v1/result/{id}
    112,970
  10. /api/v1/ioc/{id}
    109,764
  11. /api/v1/rpki/{id}
    108,501
  12. /api/v1/result/{id}/progress
    106,866
  13. /api/v1/scans/{id}/jsfingerprints
    106,744
  14. /api/v1/jarm/scan/{id}
    106,738
  15. /api/v1/js-fingerprinting3/scan/{id}
    104,964

JavaScript

Scripts loaded by the 18,374 websites scanned in the last 7 days, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    4,489
  2. Bootstrap · UI framework
    2,058
  3. jQuery Migrate · JavaScript library
    1,659
  4. React · JavaScript framework
    741
  5. Marked · JavaScript library
    684
  6. Vue.js · JavaScript framework
    531
  7. Swiper · JavaScript library
    389
  8. imagesLoaded · JavaScript library
    330
  9. jQuery UI · JavaScript library
    314
  10. Slick · JavaScript library
    309
  11. Underscore.js · JavaScript library
    267
  12. Lightbox · JavaScript library
    266
  13. OWL Carousel · JavaScript library
    264
  14. Magnific Popup · JavaScript library
    247
  15. Next.js · JavaScript framework
    246

Most used third-party script providers

Registered domain serving the script

  1. cloudflare.com
    3,955
  2. googletagmanager.com
    3,777
  3. google.com
    1,551
  4. facebook.net
    1,333
  5. gstatic.com
    1,298
  6. parklogic.com
    1,181
  7. doubleclick.net
    968
  8. jsdelivr.net
    902
  9. ajax.googleapis.com
    887
  10. jquery.com
    796
  11. google-analytics.com
    685
  12. cloudflareinsights.com
    587
  13. clarity.ms
    584
  14. googlesyndication.com
    477
  15. maps.googleapis.com
    434

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    3,504
  2. challenges.cloudflare.com/turnstile/v0/api.js
    2,257
  3. challenges.cloudflare.com/turnstile/v0/b/8340802ab0bb/api.js
    2,070
  4. www.googletagmanager.com/gtm.js
    1,837
  5. parking3.parklogic.com/page/enhance.js
    1,181
  6. connect.facebook.net/en_US/fbevents.js
    1,175
  7. challenges.cloudflare.com/turnstile/v0/g/5c2e6b612edd/api.js
    639
  8. www.google.com/recaptcha/api.js
    638
  9. www.google-analytics.com/analytics.js
    598
  10. www.gstatic.com/recaptcha/releases/bSuJ2xBC8cFy7pM4Z3Hu9boH/recaptcha__en.js
    534
  11. static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092
    497
  12. maps.googleapis.com/maps/api/js
    432
  13. www.google.com/recaptcha/api2/webworker.js
    421
  14. ep2.adtrafficquality.google/sodar/sodar2.js
    395
  15. snap.licdn.com/li.lms-analytics/insight.min.js
    372

Most common first-party scripts

Script path served from the website's own domain

  1. /_next/static/chunks/0cz1d0mv5g_q7.js
    1,950
  2. /_next/static/chunks/1ntn7efqc-iiw.js
    1,652
  3. /_next/static/chunks/14_fsmfcbrrbe.js
    1,644
  4. /_next/static/chunks/1jexzsn2qdw84.js
    1,643
  5. /_next/static/chunks/2g05-lers809t.js
    1,643
  6. /_next/static/chunks/3nc6x0_y5iwnk.js
    1,641
  7. /_next/static/chunks/3z-oetkpttgun.js
    1,627
  8. /_next/static/chunks/turbopack-3p84inqw3zu8w.js
    1,624
  9. /_next/static/chunks/3riw0-7aeplln.js
    1,607
  10. /_next/static/chunks/31epa9yds3scr.js
    1,500
  11. /wp-includes/js/jquery/jquery.min.js
    1,500
  12. /_next/static/chunks/04u9x8_fzw9b5.js
    1,443
  13. /_next/static/chunks/12j-n_j2swqsy.js
    1,433
  14. /_next/static/chunks/3pv9ea13-4r3q.js
    1,411
  15. /_next/static/chunks/1vw9u947zekpa.js
    1,378

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.7,2761,843 (25%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.4,1671,832 (44%)
27d40d40d00040d00041d41d00041d5c54a1f00e65091ffab50f9203d10672Fastly, Inc.3,7831,726 (46%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.1,842653 (35%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.1,628163 (10%)
27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5Akamai Connected Cloud1,477413 (28%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.1,3501,048 (78%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.1,312693 (53%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.993128 (13%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE747108 (14%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bMicrosoft Corporation48299 (21%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC45278 (17%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.41756 (13%)
29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeODERLAND Webbhotell AB411145 (35%)
16d3fd16d29d29d00042d43d00000071784fa9f8305ba9220d0a7894b6ff2cLoopia AB3992 (1%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
1cd28d28d00028d1cc1cd28d1cd28d9c79288798d410bef4d146627a5cd322Wildcard UK Limited2724 (89%)
2ad2ad16d2ad2ad22c42d42d0000006f254909a73bf62f6b28507e9fb451b5Sify Limited1513 (87%)
3fd3fd0003fd3fd00042d43d0000002059a3b916699461c5923779b77cf06bNetsec Limited4636 (78%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.1,3501,048 (78%)
2ad2ad0002ad2ad00042d42d0000004730e1a02fb93a679b09eac9e25c22fcStrato GmbH1914 (74%)
3fd3fd0003fd3fd21c42d42d000000307ee0eb468e9fdb5cfcd698a80a67efTencent Building, Kejizhongyi Avenue2719 (70%)
29d29d20d29d29d21c42d42d0000000f0f2ea251d805c4640f820a3394a07aEdgenext Legend Dynasty Pte. Ltd.2013 (65%)
1dd40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08dAdvin Services LLC10769 (64%)
29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158ddOracle Corporation117 (64%)
29d29d00029d29d00042d42d00000090d94d1f02cef4051cfd1d66dbe44eb0Alibaba (US) Technology Co., Ltd.4628 (61%)
29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1Oracle Corporation197117 (59%)
3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763AROSSCLOUD INC.8852 (59%)
3fd3fd0003fd3fd00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356Node Host Limited1710 (59%)
29d3fd00029d29d00042d43d0000005d86ccb1a0567e012264097a0315d7a7FranTech Solutions116 (55%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.1,312693 (53%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.16,5185,395 (33%)
t130200_1302_a56c5b993250Akamai Connected Cloud9,9482,444 (25%)
t130200_1301_a56c5b993250Amazon.com, Inc.7,3512,204 (30%)
t130200_1303_a56c5b993250Amazon.com, Inc.3,5841,455 (41%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.31320 (6%)
t1204h2_c030_b252f78b95f6IP Pathways, LLC9113 (14%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.8416 (19%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC8327 (33%)
t1207h2_c02f_b948729f6510Alibaba Cloud (Singapore) Private Limited8117 (21%)
t130200_1301_234ea6891581SiteVision AB734 (5%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.676 (9%)
t1207h1_c02f_b948729f6510ParkLogic Pty Ltd6616 (24%)
t1207h1_c030_b948729f6510Akamai Technologies, Inc.549 (17%)
t120400_c02f_1d13d5853fceAdobe Inc.491 (2%)
t1203h2_c030_340ed812b110Microsoft Corporation472 (4%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t1205h1_c008_845f7282a956Wildcard UK Limited2825 (89%)
t130200_1303_a56c5b993250Amazon.com, Inc.3,5841,455 (41%)
t1205h2_c030_845f7282a956Google LLC207 (35%)
t130200_1302_234ea6891581Cloudflare, Inc.16,5185,395 (33%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC8327 (33%)
t130200_1301_a56c5b993250Amazon.com, Inc.7,3512,204 (30%)
t130200_1303_234ea6891581Yelles AB328 (25%)
t130200_1302_a56c5b993250Akamai Connected Cloud9,9482,444 (25%)
t1207h1_c02f_b948729f6510ParkLogic Pty Ltd6616 (24%)
t1205h1_c02f_845f7282a956Amazon.com, Inc.327 (22%)
t1207h2_c02f_b948729f6510Alibaba Cloud (Singapore) Private Limited8117 (21%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.8416 (19%)
t1207h1_c030_b948729f6510Akamai Technologies, Inc.549 (17%)
t1204h2_c030_b252f78b95f6IP Pathways, LLC9113 (14%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.676 (9%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 30–60 minutes depending on the window · generated 2026-11-10 10:31 UTC.