{"report_id":"07d39876-fb23-49d1-a803-f6274dee5825","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-08-11T10:56:24Z","url":{"schema":"http","addr":"sinkrone.com/saiko/action.htm","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"ip":{"addr":"103.112.245.8","port":0,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"final":{"url":{"schema":"https","addr":"sinkrone.com/saiko/action.htm","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"title":"Sign On to View Your Personal Accounts","dom":{"size":52209,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (853)","md5":"e953d58d5b83fb74aa4fb25e2461430a","sha1":"12659ce740aaa4d85b665e2e0c211e91ebf883b7","sha256":"c4286bc173651f1438798d3dbfaa06c38282f672687413f374e33abcf032a87f","sha512":"8afa3963f2febb129d0aeaeb970b9cfd5e77920d53adce4e0430aa747b81a458f40d85948bdb9029fc53dfbf767da9046314c193344a9c7e4b94a1fb2f68380b","ssdeep":"768:/x7SYUmm6d0Th3B/iDRpgfmiOpMfQpzfKVRr8rtfrt/f:hSRmFpmfsyfQxfQRr8rtfrt/f","tlshash":"f633d61003f4083ad153c184b956b90a7a88f53b9b8aa644faac0fa97fd7c954c7f1dd","dom_hash":"domhashf1ebab6ebf56b0fc44360a47305ac7f2","first_seen":"2026-08-11T09:51:01.456581Z","last_seen":"2026-08-11T10:56:25.441151Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sinkrone.com/saiko/action.htm","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"ip":{"addr":"103.112.245.8","port":0,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-15T10:56:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-11","alert":"Detects file containing Telegram Bot API","trigger":"sinkrone.com/saiko/action.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"sinkrone.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"www15.wellsfargomedia.com","ip":{"addr":"2.20.165.48","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2009-06-25","domain_rank":196163,"first_seen":"2019-09-12T19:28:23Z","last_seen":"2026-08-08T14:49:53.511278Z","alert_count":0,"request_count":4,"received_data":95516,"sent_data":2182,"comment":"","tags":null,"fingerprints":null},{"fqdn":"sinkrone.com","ip":{"addr":"103.112.245.8","port":443,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"domain_registered":"2016-02-22","domain_rank":0,"first_seen":"2025-11-04T10:03:04.393019Z","last_seen":"2026-08-11T09:50:59.168675Z","alert_count":5,"request_count":3,"received_data":56286,"sent_data":1560,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"dl.dropboxusercontent.com","ip":{"addr":"162.125.71.15","port":443,"asn":19679,"as":"DROPBOX","country":"United States","country_code":"US"},"domain_registered":"2012-01-13","domain_rank":153412,"first_seen":"2019-02-11T02:24:40Z","last_seen":"2026-08-06T17:27:03.061535Z","alert_count":0,"request_count":4,"received_data":228520,"sent_data":2162,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"sinkrone.com/saiko/action.htm","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"ip":{"addr":"103.112.245.8","port":443,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"md5":"683acf9209bd2ffbc0fe43739e163b44","sha1":"87dfb64296e4cf9f25a78715c456755ef291e707","sha256":"cb8599a64bb3b904d28ac030fa6ab99a2ea4db1a4dc45f5b21d403dc99c8c845","sha512":"b3fdd61fff24147653272b8219139be50c0c6649c82e8812da8d6b004397b5ac0fc8257a1bb049d08a86722dd6885d02ad92274f0b7e3ade495e29313585cd83","size":3869,"token":"5518325707:AAHmrgqHhz-Q2cdaF2mpJ5yZcny6h_RRhOU","is_revoked":false,"bot":{"token":"5518325707:AAHmrgqHhz-Q2cdaF2mpJ5yZcny6h_RRhOU","user_id":"5518325707","username":"Managementrrboybot","first_name":"Ailment","last_name":"","chat":{"chat_id":"949877176","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"sinkrone.com/saiko/action.htm","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"ip":{"addr":"103.112.245.8","port":443,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"introduction_type":"scriptElement","is_inline":true,"md5":"683acf9209bd2ffbc0fe43739e163b44","sha1":"87dfb64296e4cf9f25a78715c456755ef291e707","sha256":"cb8599a64bb3b904d28ac030fa6ab99a2ea4db1a4dc45f5b21d403dc99c8c845","sha512":"b3fdd61fff24147653272b8219139be50c0c6649c82e8812da8d6b004397b5ac0fc8257a1bb049d08a86722dd6885d02ad92274f0b7e3ade495e29313585cd83","ssdeep":"","tlshash":"f181cc2a073a49b50393d1ab779abb817060004f7959a40bbd5c670b6f44ea279f23df","size":3869,"data":"","first_seen":"2026-08-11T09:51:01.469926Z","last_seen":"2026-08-11T10:56:25.447494Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-11","alert":"Detects file containing Telegram Bot API","trigger":"sinkrone.com/saiko/action.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"2.20.165.48","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:58.307Z","timestamp":1786445758307,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 25 Sep 2025 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:19:08:A8:BB:1D:9E:BB:E5:66:C3:61:B1:BA:A5:49:09:0E:26:C0","sha256":"F7:4B:A5:49:2F:B3:01:DE:1A:6D:B7:BD:A1:A5:8B:56:93:EE:18:79:27:AF:5F:C0:A3:41:CF:DD:74:29:26:14"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargosans-rg.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sinkrone.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dl.dropboxusercontent.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22424\r\nlast-modified: Tue, 26 Feb 2019 19:38:34 GMT\r\netag: \"5c7595ba-5798\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Wed, 11 Aug 2027 10:55:58 GMT\r\ndate: Tue, 11 Aug 2026 10:55:58 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":22424,"size_decoded":22764,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107","md5":"0a1639ebe9fab396657a62aa5233c832","sha1":"9b58164729ad918dd7255e4856f9da7f3a90bfde","sha256":"631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc","sha512":"a3786f7c1188bcbddcabe54e40dfbc77d842b1a19d2cca56cedaeb3c1a8126b3c203ac8b6297268c94aedf270be2b822aa8ac0de9e1e5c6d42bc7866324d8128","ssdeep":"384:ZWomH3hR7XCKb7GSa5mSWAmtXnCe83/17wdTgm6keJR60vqy:ZWDL7va5mSWbn4cdEmhJvy","tlshash":"cda2e16e1fb4ae24ec1c3bb164a5d0ed75c744750470c45fa331a0d626c5d4c9d86ef9","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-08-11T10:56:25.442321Z","times_seen":1346,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sinkrone.com/saiko/action.htm","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"ip":{"addr":"103.112.245.8","port":443,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-11T10:55:54.588Z","timestamp":1786445754588,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sinkrone.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Jun 2026 15:52:53 GMT","end":"Thu, 10 Sep 2026 15:52:52 GMT"},"fingerprint":{"sha1":"AB:8A:31:AC:53:01:75:6E:AE:C8:BB:15:00:A2:5F:2D:3C:26:B2:86","sha256":"0F:6A:AC:DC:75:A0:B8:B5:2F:5C:57:50:45:6E:A7:B7:36:A4:A9:AF:6B:A3:CF:50:0A:54:F8:CA:31:96:71:D4"}}},"request":{"raw":"GET /saiko/action.htm HTTP/1.1\r\nHost: sinkrone.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Sat, 28 Oct 2023 06:29:25 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7326\r\ndate: Tue, 11 Aug 2026 10:55:54 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":52761,"size_decoded":7755,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (853), with CRLF line terminators","md5":"3c2194d1060a0727491e42556b35952d","sha1":"9a086e9c9018a7e0b3f6f6a758c40c656bb93ae6","sha256":"b52f5e4b4cd52053710e6d2e4cc38bc0415093ebbf7a5c9fda43106e67b4df03","sha512":"929b4c555556824885636b8ccd6b98ee90ee89229f9b7febd0a7dbcc4e915cc23a06a85e41f8f45d558c600ee1b4f266ee60f81b260ef2a5b1fdb73f45cea282","ssdeep":"768:Xu0omm6/CT8nYLTMJtrofATvtrkfvtrjfUrgpaHaQCaQYR:XulmHPRofORkfvRjfcgpaHaQCaQYR","tlshash":"6933c71013c4083ac073c28499666b49f999a13b978a9644faac1bab7ff7c544c7f2dd","first_seen":"2026-08-11T09:51:01.458562Z","last_seen":"2026-08-11T10:56:25.443029Z","times_seen":2,"resource_available":false,"data":null}},"time_used":950,"timings":{"blocked":0,"dns":215,"connect":182,"send":0,"wait":183,"receive":0,"ssl":370},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-11","alert":"Detects file containing Telegram Bot API","trigger":"sinkrone.com/saiko/action.htm","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"sinkrone.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"dl.dropboxusercontent.com/s/mgbsjxmqcygh2lr/wfui.3dc34704aa095fbbf839.chunk.css?dl=0","fqdn":"dl.dropboxusercontent.com","domain":"dropboxusercontent.com","tld":"com"},"ip":{"addr":"162.125.71.15","port":443,"asn":19679,"as":"DROPBOX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:55.921Z","timestamp":1786445755921,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dl-au.dropboxusercontent.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 02 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"41:2A:CB:91:67:10:A1:EA:BC:B3:CD:67:A9:05:11:BF:99:18:03:C0","sha256":"17:E6:EC:FF:06:DD:41:CF:24:E9:C8:5F:D8:26:52:87:8E:7A:80:17:20:C5:1A:85:72:95:30:70:B2:E9:69:A2"}}},"request":{"raw":"GET /s/mgbsjxmqcygh2lr/wfui.3dc34704aa095fbbf839.chunk.css?dl=0 HTTP/1.1\r\nHost: dl.dropboxusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sinkrone.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\naccept-ranges: bytes\r\ncache-control: max-age=60\r\ncontent-disposition: inline; filename=\"wfui.3dc34704aa095fbbf839.chunk.css\"; filename*=UTF-8''wfui.3dc34704aa095fbbf839.chunk.css\r\ncontent-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'\r\npragma: public\r\nset-cookie: uc_session=uW4SfeNq3IT4QfhzgfrpzGpSrYTm2n3xzr8wbGYoiBVYkAA0n6Dk9NTZUFZc9XWy; Domain=dropboxusercontent.com; HttpOnly; Path=/; SameSite=None; Secure\r\nx-content-type-options: nosniff\r\nx-server-response-time: 345\r\ndate: Tue, 11 Aug 2026 10:55:56 GMT\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-robots-tag: noindex, nofollow, noimageindex\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-dropbox-response-origin: far_remote\r\nx-dropbox-request-id: 47e2a37f9f0844848d76e77e6a7affbc\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":100330,"size_decoded":21465,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"55a2cc51e1acd327fd5bc2edb079cdd1","sha1":"9c23f72492c4592a9bd9d0b5f4cf46db7e322436","sha256":"7fea627acd4a58ddab75dc10e4f2b430883141ede83b259aa871d62b9f6e55ec","sha512":"c040d3dbb66369c9a31abb8584d3ecfebccffe1ab26a0c3be37112d3b9ac1fd68ddc910d494d22420224f9d166e225ad72b8a225747f59624bbcd1f030cbce21","ssdeep":"3072:+Vq6JXgVxzDUDE4Q/G/C/MIQPGPCPMgQeGeCeMQQPGPCPM7LOjF7wW4dRrmSxWQg:QgVxzDUDE4Q/G/C/MIQPGPCPMgQeGeCt","tlshash":"92a3c7f16e0a5d39d077943ff183f8449e37c7216a253f6afda1a86483c3291572638a","first_seen":"2025-11-01T01:46:52.490557Z","last_seen":"2026-08-11T10:56:25.444256Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1069,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":850,"receive":0,"ssl":212},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dl.dropboxusercontent.com/s/n5dype2wvrn6j7j/main.62a557a6c2784a3722c9.chunk.css?dl=0s","fqdn":"dl.dropboxusercontent.com","domain":"dropboxusercontent.com","tld":"com"},"ip":{"addr":"162.125.71.15","port":443,"asn":19679,"as":"DROPBOX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:55.927Z","timestamp":1786445755927,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dl-au.dropboxusercontent.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 02 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"41:2A:CB:91:67:10:A1:EA:BC:B3:CD:67:A9:05:11:BF:99:18:03:C0","sha256":"17:E6:EC:FF:06:DD:41:CF:24:E9:C8:5F:D8:26:52:87:8E:7A:80:17:20:C5:1A:85:72:95:30:70:B2:E9:69:A2"}}},"request":{"raw":"GET /s/n5dype2wvrn6j7j/main.62a557a6c2784a3722c9.chunk.css?dl=0s HTTP/1.1\r\nHost: dl.dropboxusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sinkrone.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\naccept-ranges: bytes\r\ncache-control: max-age=60\r\ncontent-disposition: inline; filename=\"main.62a557a6c2784a3722c9.chunk.css\"; filename*=UTF-8''main.62a557a6c2784a3722c9.chunk.css\r\ncontent-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'\r\npragma: public\r\nset-cookie: uc_session=ebiHdXD4izIgzOoY95dGIP6wQOOxyPupF2ZbKbF5f9JEadQrFtB5mOFB1cjFFS4U; Domain=dropboxusercontent.com; HttpOnly; Path=/; SameSite=None; Secure\r\nx-content-type-options: nosniff\r\nx-server-response-time: 317\r\ndate: Tue, 11 Aug 2026 10:55:56 GMT\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-robots-tag: noindex, nofollow, noimageindex\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-dropbox-response-origin: far_remote\r\nx-dropbox-request-id: e56e6ef2713b49c38ad96ff66a7affbc\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":11730,"size_decoded":3183,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (11730), with no line terminators","md5":"4f9653c49b297c12cc1766b78483ad3a","sha1":"d2a3e043d9dd2ef5ccf3984a7f916e53d1da5f6e","sha256":"388f2ffe9aecbcf983f8d803ba670962125f24d73ee9326a8825c735e7be244a","sha512":"5e846b1c4f7228760405132139f1bde6b2e819956e1ee18d39605915ecbac4770e8a62db76f2568f4ca4e5035239325ca9f127b70a9c392b7f59810197c6a8b0","ssdeep":"192:2Ba5xoAJtcubCMuWbn6OiF94LH7dPqbz+FcWRsgd93K79C3URJK9Rvg762tpDd6k:2Ba5xjtcubCMFbn6OiF94LH7d19Zu","tlshash":"f53251eb9b8142dccc3b8c8f74c3d4456c1f681efa8a149ee99a69a09bd71411631fd2","first_seen":"2025-11-01T01:46:52.478103Z","last_seen":"2026-08-11T10:56:25.44517Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1035,"timings":{"blocked":-1,"dns":0,"connect":3,"send":0,"wait":819,"receive":0,"ssl":211},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sinkrone.com/saiko/files/COB-BOB-IRT-enroll_park.jpg","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"ip":{"addr":"103.112.245.8","port":443,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:55.933Z","timestamp":1786445755933,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sinkrone.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Jun 2026 15:52:53 GMT","end":"Thu, 10 Sep 2026 15:52:52 GMT"},"fingerprint":{"sha1":"AB:8A:31:AC:53:01:75:6E:AE:C8:BB:15:00:A2:5F:2D:3C:26:B2:86","sha256":"0F:6A:AC:DC:75:A0:B8:B5:2F:5C:57:50:45:6E:A7:B7:36:A4:A9:AF:6B:A3:CF:50:0A:54:F8:CA:31:96:71:D4"}}},"request":{"raw":"GET /saiko/files/COB-BOB-IRT-enroll_park.jpg HTTP/1.1\r\nHost: sinkrone.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sinkrone.com/saiko/action.htm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Tue, 11 Aug 2026 10:55:55 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1637,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-08-11T12:43:04.106919Z","times_seen":148883,"resource_available":true,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"sinkrone.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"2.20.165.48","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:58.029Z","timestamp":1786445758029,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 25 Sep 2025 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:19:08:A8:BB:1D:9E:BB:E5:66:C3:61:B1:BA:A5:49:09:0E:26:C0","sha256":"F7:4B:A5:49:2F:B3:01:DE:1A:6D:B7:BD:A1:A5:8B:56:93:EE:18:79:27:AF:5F:C0:A3:41:CF:DD:74:29:26:14"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargoserif-rg.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sinkrone.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dl.dropboxusercontent.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 26708\r\nlast-modified: Mon, 11 Mar 2019 20:52:01 GMT\r\netag: \"5c86ca71-6854\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Wed, 11 Aug 2027 10:55:58 GMT\r\ndate: Tue, 11 Aug 2026 10:55:58 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":26708,"size_decoded":27048,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26708, version 1.13107","md5":"885d42ab7ffcffc42ed29816c3ce9727","sha1":"3d84cb41ddfb5bf8627e2b9dc867237bea47baad","sha256":"aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310","sha512":"1b64ea9a7598a69dc5837f70af7eb702171fb55dfc58aa071a5efe70522676da4cbc1d3af054ab3b8f325143479d484388917e015e9ab61b5b7322077461fb11","ssdeep":"768:NqcUCwKb4mdzrl3vUSwXTRoji0iG6dlLsCPlT:NqrCwkTlLwV0izRPZ","tlshash":"c4c2e2c8099724dedb6d81eea692155e3f01c2df861a009a419ecc4c0c9dcdc9b9337e","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-08-11T10:56:25.446393Z","times_seen":252,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":35,"connect":1,"send":0,"wait":9,"receive":1,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"2.20.165.48","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:58.032Z","timestamp":1786445758032,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 25 Sep 2025 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:19:08:A8:BB:1D:9E:BB:E5:66:C3:61:B1:BA:A5:49:09:0E:26:C0","sha256":"F7:4B:A5:49:2F:B3:01:DE:1A:6D:B7:BD:A1:A5:8B:56:93:EE:18:79:27:AF:5F:C0:A3:41:CF:DD:74:29:26:14"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargosans-sbd.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sinkrone.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dl.dropboxusercontent.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22600\r\nlast-modified: Tue, 26 Feb 2019 19:38:34 GMT\r\netag: \"5c7595ba-5848\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Wed, 11 Aug 2027 10:55:58 GMT\r\ndate: Tue, 11 Aug 2026 10:55:58 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":22600,"size_decoded":22940,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107","md5":"83df8749c013f13019fa8e0912041759","sha1":"2bbffcf012a59e47661c0a37edda0fc772992ae7","sha256":"ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba","sha512":"60ef81e9500e9b33e9d799d4bd56f8ef4df5dfdc88a42d5739c3da65733cfaedd42aa0dc623d46b370dc750c693cbe0c473c92e6c4c2a7bed2c7da33b8bcee84","ssdeep":"384:X4TnfMKBnolaid+tMKsLZqy+1EooqFdf8THOgmFtI2ErNX0sAZwk+pcHgXvCdFPh:XWXBolb+tMKoc1E1qFdgHOujisY+pcHt","tlshash":"5ba2d0f0681f37b4473b083c3472a3ca80f69516eaea19951b3d123e699ada5934c37d","first_seen":"2023-04-13T05:35:56Z","last_seen":"2026-08-11T10:56:25.446927Z","times_seen":1176,"resource_available":false,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":33,"connect":2,"send":0,"wait":7,"receive":1,"ssl":216},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dl.dropboxusercontent.com/s/n5dype2wvrn6j7j/main.62a557a6c2784a3722c9.chunk.css?dl=0s","fqdn":"dl.dropboxusercontent.com","domain":"dropboxusercontent.com","tld":"com"},"ip":{"addr":"162.125.71.15","port":443,"asn":19679,"as":"DROPBOX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:55.924Z","timestamp":1786445755924,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dl-au.dropboxusercontent.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 02 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"41:2A:CB:91:67:10:A1:EA:BC:B3:CD:67:A9:05:11:BF:99:18:03:C0","sha256":"17:E6:EC:FF:06:DD:41:CF:24:E9:C8:5F:D8:26:52:87:8E:7A:80:17:20:C5:1A:85:72:95:30:70:B2:E9:69:A2"}}},"request":{"raw":"GET /s/n5dype2wvrn6j7j/main.62a557a6c2784a3722c9.chunk.css?dl=0s HTTP/1.1\r\nHost: dl.dropboxusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sinkrone.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\naccept-ranges: bytes\r\ncache-control: max-age=60\r\ncontent-disposition: inline; filename=\"main.62a557a6c2784a3722c9.chunk.css\"; filename*=UTF-8''main.62a557a6c2784a3722c9.chunk.css\r\ncontent-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'\r\npragma: public\r\nset-cookie: uc_session=leimbKl8VzOyAYy4NMOIJZLvnlFnvRRVWPPBq1ReStahfAttVJFBjIb6nQCE6DPO; Domain=dropboxusercontent.com; HttpOnly; Path=/; SameSite=None; Secure\r\nx-content-type-options: nosniff\r\nx-server-response-time: 385\r\ndate: Tue, 11 Aug 2026 10:55:56 GMT\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-robots-tag: noindex, nofollow, noimageindex\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-dropbox-response-origin: far_remote\r\nx-dropbox-request-id: e1ee159e25cb4d07b92fb3866a7affbb\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":11730,"size_decoded":3183,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (11730), with no line terminators","md5":"4f9653c49b297c12cc1766b78483ad3a","sha1":"d2a3e043d9dd2ef5ccf3984a7f916e53d1da5f6e","sha256":"388f2ffe9aecbcf983f8d803ba670962125f24d73ee9326a8825c735e7be244a","sha512":"5e846b1c4f7228760405132139f1bde6b2e819956e1ee18d39605915ecbac4770e8a62db76f2568f4ca4e5035239325ca9f127b70a9c392b7f59810197c6a8b0","ssdeep":"192:2Ba5xoAJtcubCMuWbn6OiF94LH7dPqbz+FcWRsgd93K79C3URJK9Rvg762tpDd6k:2Ba5xjtcubCMFbn6OiF94LH7d19Zu","tlshash":"f53251eb9b8142dccc3b8c8f74c3d4456c1f681efa8a149ee99a69a09bd71411631fd2","first_seen":"2025-11-01T01:46:52.478103Z","last_seen":"2026-08-11T10:56:25.44517Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1386,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":1371,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"dl.dropboxusercontent.com/s/mgbsjxmqcygh2lr/wfui.3dc34704aa095fbbf839.chunk.css?dl=0","fqdn":"dl.dropboxusercontent.com","domain":"dropboxusercontent.com","tld":"com"},"ip":{"addr":"162.125.71.15","port":443,"asn":19679,"as":"DROPBOX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:55.925Z","timestamp":1786445755925,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dl-au.dropboxusercontent.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 02 Mar 2026 00:00:00 GMT","end":"Wed, 16 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"41:2A:CB:91:67:10:A1:EA:BC:B3:CD:67:A9:05:11:BF:99:18:03:C0","sha256":"17:E6:EC:FF:06:DD:41:CF:24:E9:C8:5F:D8:26:52:87:8E:7A:80:17:20:C5:1A:85:72:95:30:70:B2:E9:69:A2"}}},"request":{"raw":"GET /s/mgbsjxmqcygh2lr/wfui.3dc34704aa095fbbf839.chunk.css?dl=0 HTTP/1.1\r\nHost: dl.dropboxusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sinkrone.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\naccept-ranges: bytes\r\ncache-control: max-age=60\r\ncontent-disposition: inline; filename=\"wfui.3dc34704aa095fbbf839.chunk.css\"; filename*=UTF-8''wfui.3dc34704aa095fbbf839.chunk.css\r\ncontent-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'\r\npragma: public\r\nset-cookie: uc_session=L7xRYnDAxs0vQpAIJwxpFxqcMSvxPOzJs7ujLnUjbxqQXRYr6dB9kFtGUa7OEgGh; Domain=dropboxusercontent.com; HttpOnly; Path=/; SameSite=None; Secure\r\nx-content-type-options: nosniff\r\nx-server-response-time: 500\r\ndate: Tue, 11 Aug 2026 10:55:57 GMT\r\nserver: envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-robots-tag: noindex, nofollow, noimageindex\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-dropbox-response-origin: far_remote\r\nx-dropbox-request-id: c5f96ed1a1e3463bb9becfab6a7affbc\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":100330,"size_decoded":21465,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"55a2cc51e1acd327fd5bc2edb079cdd1","sha1":"9c23f72492c4592a9bd9d0b5f4cf46db7e322436","sha256":"7fea627acd4a58ddab75dc10e4f2b430883141ede83b259aa871d62b9f6e55ec","sha512":"c040d3dbb66369c9a31abb8584d3ecfebccffe1ab26a0c3be37112d3b9ac1fd68ddc910d494d22420224f9d166e225ad72b8a225747f59624bbcd1f030cbce21","ssdeep":"3072:+Vq6JXgVxzDUDE4Q/G/C/MIQPGPCPMgQeGeCeMQQPGPCPM7LOjF7wW4dRrmSxWQg:QgVxzDUDE4Q/G/C/MIQPGPCPMgQeGeCt","tlshash":"92a3c7f16e0a5d39d077943ff183f8449e37c7216a253f6afda1a86483c3291572638a","first_seen":"2025-11-01T01:46:52.490557Z","last_seen":"2026-08-11T10:56:25.444256Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1654,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":1438,"receive":0,"ssl":211},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sinkrone.com/favicon.ico","fqdn":"sinkrone.com","domain":"sinkrone.com","tld":"com"},"ip":{"addr":"103.112.245.8","port":443,"asn":136107,"as":"PT. Tujuh Ion Indonesia","country":"Indonesia","country_code":"ID"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:58.011Z","timestamp":1786445758011,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_CHACHA20_POLY1305_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sinkrone.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Jun 2026 15:52:53 GMT","end":"Thu, 10 Sep 2026 15:52:52 GMT"},"fingerprint":{"sha1":"AB:8A:31:AC:53:01:75:6E:AE:C8:BB:15:00:A2:5F:2D:3C:26:B2:86","sha256":"0F:6A:AC:DC:75:A0:B8:B5:2F:5C:57:50:45:6E:A7:B7:36:A4:A9:AF:6B:A3:CF:50:0A:54:F8:CA:31:96:71:D4"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: sinkrone.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sinkrone.com/saiko/action.htm\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 1251\r\ndate: Tue, 11 Aug 2026 10:55:57 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1251,"size_decoded":1459,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"8150f458ed6fb9b1db4e5cfa57a1a281","sha1":"6e5726854d28687b560d7fdcb5c782c425c7dfb9","sha256":"4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896","sha512":"4cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c","ssdeep":"","tlshash":"c021353ec1c1560ae0271164fbc1f7a86669825291970f703b9eb176f6cd0bb56a36c8","first_seen":"2024-02-08T16:48:55Z","last_seen":"2026-08-11T12:43:04.106919Z","times_seen":148883,"resource_available":true,"data":null}},"time_used":182,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-11","alert":"Sinkholed","trigger":"sinkrone.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"2.20.165.48","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sinkrone.com/saiko/action.htm","date":"2026-08-11T10:55:58.031Z","timestamp":1786445758031,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"DigiCert Global G3 TLS ECC SHA384 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 25 Sep 2025 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C6:19:08:A8:BB:1D:9E:BB:E5:66:C3:61:B1:BA:A5:49:09:0E:26:C0","sha256":"F7:4B:A5:49:2F:B3:01:DE:1A:6D:B7:BD:A1:A5:8B:56:93:EE:18:79:27:AF:5F:C0:A3:41:CF:DD:74:29:26:14"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargosans-rg.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sinkrone.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://dl.dropboxusercontent.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22424\r\nlast-modified: Tue, 26 Feb 2019 19:38:34 GMT\r\netag: \"5c7595ba-5798\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Wed, 11 Aug 2027 10:55:58 GMT\r\ndate: Tue, 11 Aug 2026 10:55:58 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":22424,"size_decoded":22764,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107","md5":"0a1639ebe9fab396657a62aa5233c832","sha1":"9b58164729ad918dd7255e4856f9da7f3a90bfde","sha256":"631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc","sha512":"a3786f7c1188bcbddcabe54e40dfbc77d842b1a19d2cca56cedaeb3c1a8126b3c203ac8b6297268c94aedf270be2b822aa8ac0de9e1e5c6d42bc7866324d8128","ssdeep":"384:ZWomH3hR7XCKb7GSa5mSWAmtXnCe83/17wdTgm6keJR60vqy:ZWDL7va5mSWbn4cdEmhJvy","tlshash":"cda2e16e1fb4ae24ec1c3bb164a5d0ed75c744750470c45fa331a0d626c5d4c9d86ef9","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-08-11T10:56:25.442321Z","times_seen":1346,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":-1,"dns":34,"connect":2,"send":0,"wait":7,"receive":0,"ssl":213},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}