{"report_id":"29439ba1-3862-4cef-8cff-2d9991fc695d","version":6,"status":"done","tags":[],"date":"2025-12-05T16:14:29Z","url":{"schema":"https","addr":"wi6ndloch0bei.sbs/","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":0,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"title":"Plesk Obsidian 18.0.74","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":0,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-09T16:14:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs/","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com","meta":null}],"urlquery":null},"summary":[{"fqdn":"wi6ndloch0bei.sbs","ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"domain_registered":"2025-12-03","domain_rank":0,"first_seen":"2025-12-05T12:19:37.367194Z","last_seen":"2025-12-05T12:19:37.367194Z","alert_count":470,"request_count":94,"received_data":33058057,"sent_data":45965,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Prototype","description":"Prototype is a JavaScript Framework that aims to ease development of web applications.","website":"https://www.prototypejs.org","common_platform_enumeration":"cpe:2.3:a:prototypejs:prototype:*:*:*:*:*:*:*:*","icon":"Prototype.png","categories":["JavaScript frameworks"]},{"name":"RequireJS","description":"RequireJS is a JavaScript library and file loader which manages the dependencies between JavaScript files and in modular programming.","website":"https://requirejs.org","common_platform_enumeration":"","icon":"RequireJS.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"uat-proxy.plesk.com","ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"1999-06-13","domain_rank":0,"first_seen":"2025-08-21T20:20:46.51845Z","last_seen":"2025-12-04T00:54:20.566328Z","alert_count":0,"request_count":20,"received_data":20440,"sent_data":15820,"comment":"","tags":null,"fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"sentry.io","ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2012-04-07","domain_rank":135,"first_seen":"2016-08-31T05:38:44Z","last_seen":"2025-12-01T00:48:48.650759Z","alert_count":0,"request_count":7,"received_data":3772,"sent_data":4375,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","size":96954,"data":"","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","size":668031,"data":"","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","size":18383,"data":"","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"25e98aa87a20d1cc16ae96bb8f7b66bf","sha1":"5ce49505d556017482e53f21e53957eff01c80d7","sha256":"23268e1cc30b995c9c8a73f391d52ff6b6d94c5a7bea6e4a851c2961db3dde9f","sha512":"b82018ebb9940fdf17686ac0cc3981003537efa6be9d41fa7b9e058dd99bfc224a7d5e49f6b2c40710e761e1a7044296c68c8b391c255795e3f48c8b8ab0f302","ssdeep":"","tlshash":"29d022090da80012affeb08cef1362248cd3abf2400f8841b2ddb2d95a234768348462","size":196,"data":"","first_seen":"2025-11-25T11:36:14.668177Z","last_seen":"2025-12-09T02:51:27.094873Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"be7833429bcfcc84adbe447f29a9da89","sha1":"780f64d66114e8b830ab8af7b789fbeeb4eb3619","sha256":"21cf29a3b4003a2b52da4264e556cb622466ed13abd6b112a66ef0f514512099","sha512":"89e707dd819218a7286cc587f2db20e25e163f7c33aa66f009c6cd853615a40ff827621057a1364c88079203883ec29532b3de6bf015bfc4634d5000acdb0d5c","ssdeep":"","tlshash":"aaf05c122a81983bf49f94be26243b86513d7403e2d55c94a29ac7204bf08f4041111a","size":485,"data":"","first_seen":"2025-11-30T10:57:57.672222Z","last_seen":"2025-12-05T16:14:56.172954Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"9d0ac17058224a3a4b4a8efc10d4aaa0","sha1":"d9b09325edc2e80537f39581724a67a266bca2f9","sha256":"080c80310cdcb0fcce0a3910a3ec9db3e2d6b5512e4b3e4b859e84c72b5d72d4","sha512":"dab1e45aa4e290b8ba69b60816ce64392829e1d1ac1cb64bff693236f925d0575d242350a7e782b4abc466eb34aaaa0674952d02ec2ea7419e6976842a0ce30b","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuuxs4RRuc:5TE9YBwore2zMvtyH6cP4hSAuuxrRYc","tlshash":"323594ab304476bb0eebc153986b794530f17276349a40987a3ca5dedb749482d23f3b","size":1124576,"data":"","first_seen":"2025-11-21T03:19:34.283458Z","last_seen":"2025-12-09T02:51:27.095473Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ce5516ca4325ace76c653fe5efb16c2","sha1":"4554b47a2254c709eac0d4d538e6460dbc901eda","sha256":"fd11c154f41ba3e6c5fa18876d6f4fa30e758b89fe09538ca360c7ab7935cd59","sha512":"b168663a71c7536284fc9f87b67cb2358a97aaf20efd0fcd80e04ca53bd4ed568252d132eea54874e206c4d2fb8de62272e25e3d193861cafd4abe8dd4c33b5b","ssdeep":"49152:6y8KZDaEexjD0MczXwVfNmlpz0lxUTBN7bpTgsF4hApYnKxQhwA0MNlqWdJz9YB7:AKZ1We7h4sxZCiBDX","tlshash":"51f54ac931d1b07643e352a9807f1106f23a1969644dc4a4b678d8ee6cf9c8da27bf3d","size":3529419,"data":"","first_seen":"2025-11-14T10:26:53.510808Z","last_seen":"2026-07-12T12:58:11.677264Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"4ba9671892ee40ef730a9de509f739aa","sha1":"fb9d10e170d9e076a15dafcc6f6c72c7e6dea4e9","sha256":"89e0312bdb2d175a6b1fe8e30843f86a88f45354029b304c48baa69a776df696","sha512":"90c16df095fd6dfb29d4b592e9ac8e5731fd3c76d70aaa75d2f22d4246e15f8d2871c83d0db7c6ffa110d094bb7cebbced39bf6b6333ae38e8ad723f133281f0","ssdeep":"","tlshash":"f990021428665155d485402115467411a59639ae54172e61de145765178609142685e4","size":51,"data":"","first_seen":"2023-03-08T15:21:27Z","last_seen":"2026-07-18T09:57:56.233022Z","times_seen":2180,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"dc2ff3d1f62ef83bae620b16447bf46b","sha1":"d4de8eeb834127f97f55268cd4f00d0378a94a2a","sha256":"be2a6f70a8662ac1d22a51d112cc92059b14af44fc0bd40b9f78364d5d76881a","sha512":"764f3ee49c79664e456f721b66ad664cf6bb4a8a0e1b16a0e7ab55296a1693636149baf1e0edefa43885dce89efd810011f43a63f6038fef98607a24d8d82f9e","ssdeep":"768:NAg2VkT82a3yto6j2PUyKynm6xzw2v8OBW+8p+4Mz3xh5vc5qpzrYjaNIq7K5IWq:Nr2OIyto6j2Z7nm6xzw2fMZwrDpO/oF","tlshash":"8c93e50909253f3b07cb23f77c9b258dbab481d0a1d810546dee846912eef9de52f16b","size":89021,"data":"","first_seen":"2025-11-30T10:57:57.674169Z","last_seen":"2025-12-05T16:14:56.179564Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","size":17753,"data":"","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","size":18383,"data":"","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ce5516ca4325ace76c653fe5efb16c2","sha1":"4554b47a2254c709eac0d4d538e6460dbc901eda","sha256":"fd11c154f41ba3e6c5fa18876d6f4fa30e758b89fe09538ca360c7ab7935cd59","sha512":"b168663a71c7536284fc9f87b67cb2358a97aaf20efd0fcd80e04ca53bd4ed568252d132eea54874e206c4d2fb8de62272e25e3d193861cafd4abe8dd4c33b5b","ssdeep":"49152:6y8KZDaEexjD0MczXwVfNmlpz0lxUTBN7bpTgsF4hApYnKxQhwA0MNlqWdJz9YB7:AKZ1We7h4sxZCiBDX","tlshash":"51f54ac931d1b07643e352a9807f1106f23a1969644dc4a4b678d8ee6cf9c8da27bf3d","size":3529419,"data":"","first_seen":"2025-11-14T10:26:53.510808Z","last_seen":"2026-07-12T12:58:11.677264Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","size":96954,"data":"","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","size":668031,"data":"","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","size":17753,"data":"","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","size":96954,"data":"","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ce5516ca4325ace76c653fe5efb16c2","sha1":"4554b47a2254c709eac0d4d538e6460dbc901eda","sha256":"fd11c154f41ba3e6c5fa18876d6f4fa30e758b89fe09538ca360c7ab7935cd59","sha512":"b168663a71c7536284fc9f87b67cb2358a97aaf20efd0fcd80e04ca53bd4ed568252d132eea54874e206c4d2fb8de62272e25e3d193861cafd4abe8dd4c33b5b","ssdeep":"49152:6y8KZDaEexjD0MczXwVfNmlpz0lxUTBN7bpTgsF4hApYnKxQhwA0MNlqWdJz9YB7:AKZ1We7h4sxZCiBDX","tlshash":"51f54ac931d1b07643e352a9807f1106f23a1969644dc4a4b678d8ee6cf9c8da27bf3d","size":3529419,"data":"","first_seen":"2025-11-14T10:26:53.510808Z","last_seen":"2026-07-12T12:58:11.677264Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"9d0ac17058224a3a4b4a8efc10d4aaa0","sha1":"d9b09325edc2e80537f39581724a67a266bca2f9","sha256":"080c80310cdcb0fcce0a3910a3ec9db3e2d6b5512e4b3e4b859e84c72b5d72d4","sha512":"dab1e45aa4e290b8ba69b60816ce64392829e1d1ac1cb64bff693236f925d0575d242350a7e782b4abc466eb34aaaa0674952d02ec2ea7419e6976842a0ce30b","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuuxs4RRuc:5TE9YBwore2zMvtyH6cP4hSAuuxrRYc","tlshash":"323594ab304476bb0eebc153986b794530f17276349a40987a3ca5dedb749482d23f3b","size":1124576,"data":"","first_seen":"2025-11-21T03:19:34.283458Z","last_seen":"2025-12-09T02:51:27.095473Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","size":18383,"data":"","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","size":668031,"data":"","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","size":728,"data":"","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","size":728,"data":"","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","size":17753,"data":"","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","size":18383,"data":"","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","size":18383,"data":"","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","size":668031,"data":"","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","size":17753,"data":"","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ce5516ca4325ace76c653fe5efb16c2","sha1":"4554b47a2254c709eac0d4d538e6460dbc901eda","sha256":"fd11c154f41ba3e6c5fa18876d6f4fa30e758b89fe09538ca360c7ab7935cd59","sha512":"b168663a71c7536284fc9f87b67cb2358a97aaf20efd0fcd80e04ca53bd4ed568252d132eea54874e206c4d2fb8de62272e25e3d193861cafd4abe8dd4c33b5b","ssdeep":"49152:6y8KZDaEexjD0MczXwVfNmlpz0lxUTBN7bpTgsF4hApYnKxQhwA0MNlqWdJz9YB7:AKZ1We7h4sxZCiBDX","tlshash":"51f54ac931d1b07643e352a9807f1106f23a1969644dc4a4b678d8ee6cf9c8da27bf3d","size":3529419,"data":"","first_seen":"2025-11-14T10:26:53.510808Z","last_seen":"2026-07-12T12:58:11.677264Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"9d0ac17058224a3a4b4a8efc10d4aaa0","sha1":"d9b09325edc2e80537f39581724a67a266bca2f9","sha256":"080c80310cdcb0fcce0a3910a3ec9db3e2d6b5512e4b3e4b859e84c72b5d72d4","sha512":"dab1e45aa4e290b8ba69b60816ce64392829e1d1ac1cb64bff693236f925d0575d242350a7e782b4abc466eb34aaaa0674952d02ec2ea7419e6976842a0ce30b","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuuxs4RRuc:5TE9YBwore2zMvtyH6cP4hSAuuxrRYc","tlshash":"323594ab304476bb0eebc153986b794530f17276349a40987a3ca5dedb749482d23f3b","size":1124576,"data":"","first_seen":"2025-11-21T03:19:34.283458Z","last_seen":"2025-12-09T02:51:27.095473Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"9d0ac17058224a3a4b4a8efc10d4aaa0","sha1":"d9b09325edc2e80537f39581724a67a266bca2f9","sha256":"080c80310cdcb0fcce0a3910a3ec9db3e2d6b5512e4b3e4b859e84c72b5d72d4","sha512":"dab1e45aa4e290b8ba69b60816ce64392829e1d1ac1cb64bff693236f925d0575d242350a7e782b4abc466eb34aaaa0674952d02ec2ea7419e6976842a0ce30b","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuuxs4RRuc:5TE9YBwore2zMvtyH6cP4hSAuuxrRYc","tlshash":"323594ab304476bb0eebc153986b794530f17276349a40987a3ca5dedb749482d23f3b","size":1124576,"data":"","first_seen":"2025-11-21T03:19:34.283458Z","last_seen":"2025-12-09T02:51:27.095473Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","size":728,"data":"","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ce5516ca4325ace76c653fe5efb16c2","sha1":"4554b47a2254c709eac0d4d538e6460dbc901eda","sha256":"fd11c154f41ba3e6c5fa18876d6f4fa30e758b89fe09538ca360c7ab7935cd59","sha512":"b168663a71c7536284fc9f87b67cb2358a97aaf20efd0fcd80e04ca53bd4ed568252d132eea54874e206c4d2fb8de62272e25e3d193861cafd4abe8dd4c33b5b","ssdeep":"49152:6y8KZDaEexjD0MczXwVfNmlpz0lxUTBN7bpTgsF4hApYnKxQhwA0MNlqWdJz9YB7:AKZ1We7h4sxZCiBDX","tlshash":"51f54ac931d1b07643e352a9807f1106f23a1969644dc4a4b678d8ee6cf9c8da27bf3d","size":3529419,"data":"","first_seen":"2025-11-14T10:26:53.510808Z","last_seen":"2026-07-12T12:58:11.677264Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","size":728,"data":"","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"9d0ac17058224a3a4b4a8efc10d4aaa0","sha1":"d9b09325edc2e80537f39581724a67a266bca2f9","sha256":"080c80310cdcb0fcce0a3910a3ec9db3e2d6b5512e4b3e4b859e84c72b5d72d4","sha512":"dab1e45aa4e290b8ba69b60816ce64392829e1d1ac1cb64bff693236f925d0575d242350a7e782b4abc466eb34aaaa0674952d02ec2ea7419e6976842a0ce30b","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuuxs4RRuc:5TE9YBwore2zMvtyH6cP4hSAuuxrRYc","tlshash":"323594ab304476bb0eebc153986b794530f17276349a40987a3ca5dedb749482d23f3b","size":1124576,"data":"","first_seen":"2025-11-21T03:19:34.283458Z","last_seen":"2025-12-09T02:51:27.095473Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","size":96954,"data":"","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","size":668031,"data":"","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","size":17753,"data":"","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","size":728,"data":"","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","size":96954,"data":"","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/favicon.svg?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:16.789Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/favicon.svg?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:16 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 634\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-27a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":634,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3db793b2c015d7c858962cd0d8e6df16","sha1":"4ff02cb7383ec6ccfa2f40aa98e8a0367d59233f","sha256":"a3226d3734644e6cee2791e42f6cdb81df5a773b39177bfcf00618961628dd1f","sha512":"7ce8d6eb9670d1b5fb81e3ea6877f20856f3c9ee6b6af5cf340bb10d2d87dfc3fd6b8e2eac5754d9423a2edeaa3da009b7d205bf50eaf634d411a686cdf7f273","ssdeep":"","tlshash":"8bf0a2e11764b18d89990f75df3c7aa4491d74f9724c04d1b68c4c64708faf9ed81e80","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.750052Z","times_seen":2180,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:00.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /login.php HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 303 See Other\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: text/html; charset=utf-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlocation: https://wi6ndloch0bei.sbs:443/login_up.php\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"303","status_text":"See Other","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":43,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/images/symbols.svg?5310351284e83529c337","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.909Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/images/symbols.svg?5310351284e83529c337 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:01 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 293514\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-47a8a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":293514,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"13a2b6b7ab9d753b87dc8584ad418766","sha1":"a637bef5d57bc3ac8de7aded3670fcaabfba2af4","sha256":"425be4b5813254f9c6527b0517ad2a1ca1cdf1a7cd571d384d53e38f1ff05fb2","sha512":"5e91c733baef20a3889aeaa273823a07353af6105bc2efb0982c449bcfbc57e6b49f004e203530b0a7032c15a5ce042aef5056805b454794d2f01505269980bf","ssdeep":"3072:4GRcF7g4ZJCXpGpocUcl9solpswLwL67M7YgXCzgPbvy3i8kUrUPxcucvKYj9com:4GmJC6ULCzykhp3aZ","tlshash":"b25453b907ac86dc6257c63aef3b55e4a71e90bf71f5c0a038af97720b63011d5876a0","first_seen":"2025-06-09T20:24:31.20113Z","last_seen":"2026-07-24T10:14:24.348453Z","times_seen":951,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":94,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 61548\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-f06c\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61548,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 61548, version 1.0","md5":"e9681ca3d29d814a5621d4764dd1a11e","sha1":"bbda68459fc0531b915bdf9e524ecc8f782db0aa","sha256":"51f0bacf9e49a400a5a2947ef6b14127ef3241b0760d97721e0aedd7add66456","sha512":"f03e8536b40002c4aceb759f4e3cce90277491e4ed1b0d9c3b061d36efe8328545765e2d391a22bdd1e1d3d1e94e50ad4b18f65339c6ee0d22c02316869d808c","ssdeep":"768:/h88uQaIKMZe9H1M8KzcxRsmUYwKDSJIVeOFd+h63Lm18JXdHEAfeckzRA7Hi8:/hFSFMU9YImWvKQ2ikabi8","tlshash":"a753f1b07b32e55bfec639739a6d6311d2135c6e8b0705f642b8a050263f12babc459b","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.761911Z","times_seen":3555,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:01 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 2728\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-aa8\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2728,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9360d7ea139bd99ace88e0b99ec9429f","sha1":"542ed6c0c25874845c57a2701340eb327e926458","sha256":"372daa2218a79b1c3ccc8f83cd3f2ac98ce624a7c50e9478f997b631468c6bd0","sha512":"42c1d9ca33d2c188c87eb56b861feca28ec42eb699d5c3ba94a50dde40be3345f1eb09e3c5d792a3e4fc5b300a56b32719f75020b5e5c1881f79fd9fe0f134a5","ssdeep":"","tlshash":"e05167f71330c35c84cba4baef3ae944920ee47dbba34681829ed61468c3995f607954","first_seen":"2023-05-08T09:08:30Z","last_seen":"2026-08-15T08:57:10.752992Z","times_seen":1982,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:02.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: 5e0814eff843407a61953d76ec0e357d68f1272c186aa79594d53919a7efb425\r\nX-Amz-Date: 20251205T161401Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=b2dd6eda01e3a127117d4b7214eb1e01517c13ab2f156441455eeecf05a52ff8\r\nContent-Length: 218\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDowMS43MDVafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJ1YXQtYWlkIjoiazk5YTloYzZlNGYifQo=\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:02 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 244\r\nset-cookie: AWSALB=XGqVMrKy2nChsWlbd9xY1mMHBwFU7eyQkq+WrbxUSblOJNyVIVZbbS+7hu33J9/jTl5h/YhWkeLR3fs4LOUWSOSNHPbnuM57OQZzofgBWUgxYJLVytSAiZqH+GWy; Expires=Fri, 12 Dec 2025 16:14:02 GMT; Path=/\nAWSALBCORS=XGqVMrKy2nChsWlbd9xY1mMHBwFU7eyQkq+WrbxUSblOJNyVIVZbbS+7hu33J9/jTl5h/YhWkeLR3fs4LOUWSOSNHPbnuM57OQZzofgBWUgxYJLVytSAiZqH+GWy; Expires=Fri, 12 Dec 2025 16:14:02 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: Drk+fMQCkeztwTGihJP+q+wL3MYB8xiakhG2/fKGw/5tlERij3hQC77ExcE6BiMLf4EuAHTtU1gsD7+QXEls1Kbpk7F6LaW3\r\nx-amzn-requestid: ee47eefa-82a4-8a81-8fea-e9f066be59d5\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"894b7357feaff4265c8d53d232d41039","sha1":"46ea796c572d6ec98b6a8492be64699aa2c653d5","sha256":"ae90a899f7f142ad0ae09d008349f101e184ad304cef958219e8164fc26c4290","sha512":"fd90d47bb2a8a34ab63eab41371c9d88aecd4bf84983607d75190c511fc5c279551ce68957e1213c27f6a34010160c6184fa104b3de2141a795046eba00bf96a","ssdeep":"","tlshash":"84d0eb0d2ab0c81e9702a0123a51308ecb014e2b030c0a0cc9b2b00841a24914948560","first_seen":"2025-12-05T16:14:56.150411Z","last_seen":"2025-12-05T16:14:56.150411Z","times_seen":1,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/images/symbols.svg?5310351284e83529c337","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/images/symbols.svg?5310351284e83529c337 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 293514\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-47a8a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":293514,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"13a2b6b7ab9d753b87dc8584ad418766","sha1":"a637bef5d57bc3ac8de7aded3670fcaabfba2af4","sha256":"425be4b5813254f9c6527b0517ad2a1ca1cdf1a7cd571d384d53e38f1ff05fb2","sha512":"5e91c733baef20a3889aeaa273823a07353af6105bc2efb0982c449bcfbc57e6b49f004e203530b0a7032c15a5ce042aef5056805b454794d2f01505269980bf","ssdeep":"3072:4GRcF7g4ZJCXpGpocUcl9solpswLwL67M7YgXCzgPbvy3i8kUrUPxcucvKYj9com:4GmJC6ULCzykhp3aZ","tlshash":"b25453b907ac86dc6257c63aef3b55e4a71e90bf71f5c0a038af97720b63011d5876a0","first_seen":"2025-06-09T20:24:31.20113Z","last_seen":"2026-07-24T10:14:24.348453Z","times_seen":951,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":66,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.437Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.js?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2d8\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":728,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sentry.io/api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0","fqdn":"sentry.io","domain":"sentry.io","tld":"io"},"ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:12.811Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sentry.io","organization":"Sentry"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 24 Jul 2025 00:00:00 GMT","end":"Mon, 24 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"40:5D:97:97:7A:AA:2D:23:D7:21:D1:D4:EF:2E:3B:0D:50:F0:11:3C","sha256":"F3:73:7A:50:D7:AC:5C:4F:8E:94:6B:EC:E0:EA:D2:F8:6F:EE:EA:F8:DF:BA:97:5D:92:0E:ED:DA:82:D9:6D:BA"}}},"request":{"raw":"POST /api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0 HTTP/1.1\r\nHost: sentry.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://wi6ndloch0bei.sbs/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 431\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":431,"data":"{\"sent_at\":\"2025-12-05T16:14:12.807Z\",\"sdk\":{\"name\":\"sentry.javascript.browser\",\"version\":\"10.22.0\"}}\n{\"type\":\"session\"}\n{\"sid\":\"ae9b58b047db4966a5da896a397562f7\",\"init\":true,\"started\":\"2025-12-05T16:14:12.806Z\",\"timestamp\":\"2025-12-05T16:14:12.806Z\",\"status\":\"ok\",\"errors\":0,\"attrs\":{\"release\":\"18.0.74.2\",\"environment\":\"production\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:12 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\nx-envoy-upstream-service-time: 1\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-16T17:31:46.359709Z","times_seen":761639,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:00.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /login_up.php HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: text/html; charset=utf-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Prototype","description":"Prototype is a JavaScript Framework that aims to ease development of web applications.","website":"https://www.prototypejs.org","common_platform_enumeration":"cpe:2.3:a:prototypejs:prototype:*:*:*:*:*:*:*:*","icon":"Prototype.png","categories":["JavaScript frameworks"]},{"name":"RequireJS","description":"RequireJS is a JavaScript library and file loader which manages the dependencies between JavaScript files and in modular programming.","website":"https://requirejs.org","common_platform_enumeration":"","icon":"RequireJS.svg","categories":["JavaScript frameworks"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62506)","md5":"2a8c28d9b1653df5f667e39a3003a756","sha1":"ef88767601e89c2397cb88cb10a610b04dd5ad9e","sha256":"06e536cbe668ce4fedc75e51121e178b860808632adb1bd72ac2a811785fd92e","sha512":"8d426b3f146867d38239a2056a446bab5bf51fc226ba351ec6b3ad3a4682d267c2862e7c078289abcc648a549ab43721582e1d26dcca6a9c9e52ec7d20ffefdb","ssdeep":"1536:8sEmNSPKkr2OIyto6j2Z7nm6xzw2fMZwrDpO/oM:8sEmNSPK00B6jc7nRmwrDnM","tlshash":"b893f60909243f3b07cb23f67c9b358dbab491d0a1d85054a9ee846913eef9dd42f16b","first_seen":"2025-12-05T16:14:56.152279Z","last_seen":"2025-12-05T16:14:56.152279Z","times_seen":1,"resource_available":false,"data":null}},"time_used":184,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/css/main.css?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/css/main.css?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-58500\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":361728,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d7c3779b2d402d9c673a54173b96f22d","sha1":"ead0d04187ae89fff3723744403dba7329b8919a","sha256":"6f631cb20e1b72e4d1419801d0f041459bea3f1792e60af6e73e2fd2c8428bcf","sha512":"9e5fe3069f4e837222f3211010be4c7fd1a1a8df936defa86897cc94f239c3fd11aa2f2fba93e410c21659f216817a524c7f91b1a974b674bac8fe788fd2827f","ssdeep":"6144:S6USCdHO33ag+Y3iniVRV2Du88Sag88Sbut:cHOviispt","tlshash":"1c743d50f05931bd766b872af3e12645a31e9461e2525ffff46bf2acc2c90c41633a26","first_seen":"2025-11-14T10:26:53.473414Z","last_seen":"2026-07-12T12:58:11.592189Z","times_seen":126,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 2728\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-aa8\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2728,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9360d7ea139bd99ace88e0b99ec9429f","sha1":"542ed6c0c25874845c57a2701340eb327e926458","sha256":"372daa2218a79b1c3ccc8f83cd3f2ac98ce624a7c50e9478f997b631468c6bd0","sha512":"42c1d9ca33d2c188c87eb56b861feca28ec42eb699d5c3ba94a50dde40be3345f1eb09e3c5d792a3e4fc5b300a56b32719f75020b5e5c1881f79fd9fe0f134a5","ssdeep":"","tlshash":"e05167f71330c35c84cba4baef3ae944920ee47dbba34681829ed61468c3995f607954","first_seen":"2023-05-08T09:08:30Z","last_seen":"2026-08-15T08:57:10.752992Z","times_seen":1982,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/apple-touch-icon.png?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/apple-touch-icon.png?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: image/png\r\ncontent-length: 4528\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-11b0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4528,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ebbd61fb584cc8ae62ffa726070c952f","sha1":"7aefbffc866e859207b23f736faeac97f51414e6","sha256":"b23ec702f16e22329aa8d8a74cede38c886e609acd467517a004439cbbb1da1c","sha512":"f25e44b2827d8131d7264ac6d89c1da95b452111d92f8681b001145283cd505b7fc72f637b72d94a550247284f15d9334f4e4b8802e795378c8c6483ae68fb73","ssdeep":"96:LSlwpX/RP3oYm4HoZtygi8U/q8fDdOY0JkLTRR6U5/3:LSlwJ/RP3oYmJW7t1Dd0wTz6Uh","tlshash":"fe919e6c5303d6786bf82488136e65e5d24a76627c5397b60ea41b1e2cdc38afbc5cf0","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.747482Z","times_seen":2664,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sentry.io/api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0","fqdn":"sentry.io","domain":"sentry.io","tld":"io"},"ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:16.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sentry.io","organization":"Sentry"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 24 Jul 2025 00:00:00 GMT","end":"Mon, 24 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"40:5D:97:97:7A:AA:2D:23:D7:21:D1:D4:EF:2E:3B:0D:50:F0:11:3C","sha256":"F3:73:7A:50:D7:AC:5C:4F:8E:94:6B:EC:E0:EA:D2:F8:6F:EE:EA:F8:DF:BA:97:5D:92:0E:ED:DA:82:D9:6D:BA"}}},"request":{"raw":"POST /api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0 HTTP/1.1\r\nHost: sentry.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://wi6ndloch0bei.sbs/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 431\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":431,"data":"{\"sent_at\":\"2025-12-05T16:14:16.862Z\",\"sdk\":{\"name\":\"sentry.javascript.browser\",\"version\":\"10.22.0\"}}\n{\"type\":\"session\"}\n{\"sid\":\"51abb56219b546fa9f93332c9902c279\",\"init\":true,\"started\":\"2025-12-05T16:14:16.861Z\",\"timestamp\":\"2025-12-05T16:14:16.861Z\",\"status\":\"ok\",\"errors\":0,\"attrs\":{\"release\":\"18.0.74.2\",\"environment\":\"production\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:16 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\nx-envoy-upstream-service-time: 1\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-16T17:31:46.359709Z","times_seen":761639,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/css/main.css?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/css/main.css?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-58500\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":361728,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d7c3779b2d402d9c673a54173b96f22d","sha1":"ead0d04187ae89fff3723744403dba7329b8919a","sha256":"6f631cb20e1b72e4d1419801d0f041459bea3f1792e60af6e73e2fd2c8428bcf","sha512":"9e5fe3069f4e837222f3211010be4c7fd1a1a8df936defa86897cc94f239c3fd11aa2f2fba93e410c21659f216817a524c7f91b1a974b674bac8fe788fd2827f","ssdeep":"6144:S6USCdHO33ag+Y3iniVRV2Du88Sag88Sbut:cHOviispt","tlshash":"1c743d50f05931bd766b872af3e12645a31e9461e2525ffff46bf2acc2c90c41633a26","first_seen":"2025-11-14T10:26:53.473414Z","last_seen":"2026-07-12T12:58:11.592189Z","times_seen":126,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/apple-touch-icon.png?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/apple-touch-icon.png?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 4528\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-11b0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4528,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ebbd61fb584cc8ae62ffa726070c952f","sha1":"7aefbffc866e859207b23f736faeac97f51414e6","sha256":"b23ec702f16e22329aa8d8a74cede38c886e609acd467517a004439cbbb1da1c","sha512":"f25e44b2827d8131d7264ac6d89c1da95b452111d92f8681b001145283cd505b7fc72f637b72d94a550247284f15d9334f4e4b8802e795378c8c6483ae68fb73","ssdeep":"96:LSlwpX/RP3oYm4HoZtygi8U/q8fDdOY0JkLTRR6U5/3:LSlwJ/RP3oYmJW7t1Dd0wTz6Uh","tlshash":"fe919e6c5303d6786bf82488136e65e5d24a76627c5397b60ea41b1e2cdc38afbc5cf0","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.747482Z","times_seen":2664,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:07.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"POST /login_up.php HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 95\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":95,"data":"login_name=\u0026passwd=\u0026locale_id=default\u0026forgery_protection_token=762bb7b59fa0799ff96b78723f0aa8f8"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:07 GMT\r\ncontent-type: text/html; charset=utf-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:07 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Prototype","description":"Prototype is a JavaScript Framework that aims to ease development of web applications.","website":"https://www.prototypejs.org","common_platform_enumeration":"cpe:2.3:a:prototypejs:prototype:*:*:*:*:*:*:*:*","icon":"Prototype.png","categories":["JavaScript frameworks"]},{"name":"RequireJS","description":"RequireJS is a JavaScript library and file loader which manages the dependencies between JavaScript files and in modular programming.","website":"https://requirejs.org","common_platform_enumeration":"","icon":"RequireJS.svg","categories":["JavaScript frameworks"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62506)","md5":"c12184f83f90086f657f340666a69769","sha1":"ff13680c110220ac4a6aa3420e4fb7de541fcd86","sha256":"7ea74ee18c7918c132049d5ef1d991ca8a174a81914478ae34923887a75cb8c2","sha512":"96fdfa232f748e7b90d7d1dc14caa7b2a824ffe77d6dc20d8c4116b2a30fd19be39cfe70e5e8b940da1915b6241abec00a675f0853a796639d1b8f780c94a293","ssdeep":"1536:jsEmNSPKkr2OIyto6j2Z7nm6xzw2fMZwrDpO/oM:jsEmNSPK00B6jc7nRmwrDnM","tlshash":"6c93f60909243f3b07cb23f67c9b358dbab491d0a1d85054a9ee846913eef9dd42f16b","first_seen":"2025-12-05T16:14:56.154306Z","last_seen":"2025-12-05T16:14:56.154306Z","times_seen":1,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/apple-touch-icon.png?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/apple-touch-icon.png?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: image/png\r\ncontent-length: 4528\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-11b0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4528,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ebbd61fb584cc8ae62ffa726070c952f","sha1":"7aefbffc866e859207b23f736faeac97f51414e6","sha256":"b23ec702f16e22329aa8d8a74cede38c886e609acd467517a004439cbbb1da1c","sha512":"f25e44b2827d8131d7264ac6d89c1da95b452111d92f8681b001145283cd505b7fc72f637b72d94a550247284f15d9334f4e4b8802e795378c8c6483ae68fb73","ssdeep":"96:LSlwpX/RP3oYm4HoZtygi8U/q8fDdOY0JkLTRR6U5/3:LSlwJ/RP3oYmJW7t1Dd0wTz6Uh","tlshash":"fe919e6c5303d6786bf82488136e65e5d24a76627c5397b60ea41b1e2cdc38afbc5cf0","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.747482Z","times_seen":2664,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/notifier/global.js?1764197486 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:51:26 GMT\r\netag: W/\"6927846e-47cf\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18383,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18319)","md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: 4eb0b0b3bc83a4f8a8992c53919acd66c4143c30791656982e888de0279a75c7\r\nX-Amz-Date: 20251205T161409Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=fb67bbda97ce991ed2458750db6c6364c538bdfda5b15c425c7c3116e75601a8\r\nContent-Length: 294\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":294,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDowOS40NzNafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJwYWdlTG9hZFRpbWUiOjE1OTEsInJlcXVlc3RUaW1lIjoxMTMsInJlbmRlclRpbWUiOjE0NjYsInVhdC1haWQiOiJrOTlhOWhjNmU0ZiJ9Cg==\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 244\r\nset-cookie: AWSALB=rg8Bcf0qAdNTsufnYEAOQyUwCmZA3MtmkO2G5XCyZX3gFoQh+gBiig8NrfvXtFbWixpamazjducUgT/QuE1xWeLujIIoJaie+olYhSIDy8LaZbOegPvy6wIRh/DP; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/\nAWSALBCORS=rg8Bcf0qAdNTsufnYEAOQyUwCmZA3MtmkO2G5XCyZX3gFoQh+gBiig8NrfvXtFbWixpamazjducUgT/QuE1xWeLujIIoJaie+olYhSIDy8LaZbOegPvy6wIRh/DP; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: 1Hup0yortJVCDmbP1rH62PvcUFdX9S8wDtIfqSudU0qVKqq9JqOI+VflNbiqrFQLk4nHcJaEPZqYENc1XjTUvwAFxvcm9j/a\r\nx-amzn-requestid: cfbae5d9-1ea6-f20a-ae17-e2c8332da538\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"9c2bd3c037fd093f826d9b4414e7696f","sha1":"865cbb7af2c3b409d2f65649382335806b9b8d58","sha256":"869f54709bfeeab55c8ef40e1a40c472a78a396c3de332c4cdfcf1becdcb2392","sha512":"1cc51b83f58f1968a4e52ea87e042e398fa26f9b33608d499747b443245cae6fe7a3058c4d706bc303d0a51c4814fc9112b95d3b4608b78810a45b3501effdcf","ssdeep":"","tlshash":"76d095bcb842e27e50211bd5f34554c71725bd14da64b117cc0d55043517d8cf037671","first_seen":"2025-12-05T16:14:56.157501Z","last_seen":"2025-12-05T16:14:56.157501Z","times_seen":1,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/css/main.css?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/css/main.css?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-58500\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":361728,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d7c3779b2d402d9c673a54173b96f22d","sha1":"ead0d04187ae89fff3723744403dba7329b8919a","sha256":"6f631cb20e1b72e4d1419801d0f041459bea3f1792e60af6e73e2fd2c8428bcf","sha512":"9e5fe3069f4e837222f3211010be4c7fd1a1a8df936defa86897cc94f239c3fd11aa2f2fba93e410c21659f216817a524c7f91b1a974b674bac8fe788fd2827f","ssdeep":"6144:S6USCdHO33ag+Y3iniVRV2Du88Sag88Sbut:cHOviispt","tlshash":"1c743d50f05931bd766b872af3e12645a31e9461e2525ffff46bf2acc2c90c41633a26","first_seen":"2025-11-14T10:26:53.473414Z","last_seen":"2026-07-12T12:58:11.592189Z","times_seen":126,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/vendors.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-35dacb\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3529419,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"53eb9a138f1fa9d1840ad86e451f6451","sha1":"9d2d62cff0a0093ed1c6079eb8a3a6c8d484936a","sha256":"05dd81a0c4f64eca247e1ce31abe05d198657573989526f602b5cb7340cd5a39","sha512":"098a4967977d30a6a268267f28e853951b80ad469738f14fe1b3e8dbf39e682929abe4d231eaf6347e188886204a9f88070f7581e565e4809a5530da2e26482f","ssdeep":"24576:H9Ey0LKZDaJXZgjFUTxjD0MczXwVfNmld:6y8KZDaEexjD0MczXwVfNmld","tlshash":"762529c932c2b47257e352e9807f0106f33a1859744d8468b7acd8de78b994da23bf79","first_seen":"2025-11-14T10:26:53.480723Z","last_seen":"2026-07-12T12:58:11.620842Z","times_seen":159,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/apple-touch-icon.png?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:16.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/apple-touch-icon.png?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:16 GMT\r\ncontent-type: image/png\r\ncontent-length: 4528\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-11b0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4528,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ebbd61fb584cc8ae62ffa726070c952f","sha1":"7aefbffc866e859207b23f736faeac97f51414e6","sha256":"b23ec702f16e22329aa8d8a74cede38c886e609acd467517a004439cbbb1da1c","sha512":"f25e44b2827d8131d7264ac6d89c1da95b452111d92f8681b001145283cd505b7fc72f637b72d94a550247284f15d9334f4e4b8802e795378c8c6483ae68fb73","ssdeep":"96:LSlwpX/RP3oYm4HoZtygi8U/q8fDdOY0JkLTRR6U5/3:LSlwJ/RP3oYmJW7t1Dd0wTz6Uh","tlshash":"fe919e6c5303d6786bf82488136e65e5d24a76627c5397b60ea41b1e2cdc38afbc5cf0","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.747482Z","times_seen":2664,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/css/main.css?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.427Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/css/main.css?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-58500\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":361728,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d7c3779b2d402d9c673a54173b96f22d","sha1":"ead0d04187ae89fff3723744403dba7329b8919a","sha256":"6f631cb20e1b72e4d1419801d0f041459bea3f1792e60af6e73e2fd2c8428bcf","sha512":"9e5fe3069f4e837222f3211010be4c7fd1a1a8df936defa86897cc94f239c3fd11aa2f2fba93e410c21659f216817a524c7f91b1a974b674bac8fe788fd2827f","ssdeep":"6144:S6USCdHO33ag+Y3iniVRV2Du88Sag88Sbut:cHOviispt","tlshash":"1c743d50f05931bd766b872af3e12645a31e9461e2525ffff46bf2acc2c90c41633a26","first_seen":"2025-11-14T10:26:53.473414Z","last_seen":"2026-07-12T12:58:11.592189Z","times_seen":126,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/images/symbols.svg?5310351284e83529c337","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/images/symbols.svg?5310351284e83529c337 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 293514\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-47a8a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":293514,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"13a2b6b7ab9d753b87dc8584ad418766","sha1":"a637bef5d57bc3ac8de7aded3670fcaabfba2af4","sha256":"425be4b5813254f9c6527b0517ad2a1ca1cdf1a7cd571d384d53e38f1ff05fb2","sha512":"5e91c733baef20a3889aeaa273823a07353af6105bc2efb0982c449bcfbc57e6b49f004e203530b0a7032c15a5ce042aef5056805b454794d2f01505269980bf","ssdeep":"3072:4GRcF7g4ZJCXpGpocUcl9solpswLwL67M7YgXCzgPbvy3i8kUrUPxcucvKYj9com:4GmJC6ULCzykhp3aZ","tlshash":"b25453b907ac86dc6257c63aef3b55e4a71e90bf71f5c0a038af97720b63011d5876a0","first_seen":"2025-06-09T20:24:31.20113Z","last_seen":"2026-07-24T10:14:24.348453Z","times_seen":951,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 59600\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-e8d0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59600,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 59600, version 1.0","md5":"e78dce533ecee30c5efd812bb23c248d","sha1":"87d988c2f0343952ccded7c17b000e33db6f3d15","sha256":"03e2544599e5a06566b2579f82ac6e445b724435fccb1f3e8988e58f45b1fc5e","sha512":"84ef89585b92b235ce6d0288f2a52cd894a074bf23c29e06927ad7e3a5316bd97069b69a5246acd1d9eb6beb42b85866a1109d9591300746f11c515d959d82b8","ssdeep":"1536:OOgE9AeA+6fIVtMLSaRUArskS2m21Cgbv+M7+Do/N1:AE5A+6ksSaRPAHw0ov","tlshash":"4543f1155519c890cd26783c89b9aee180b06eb4c2480ef76f9c3685fee1767f6137a4","first_seen":"2023-04-06T18:57:36Z","last_seen":"2026-08-15T08:57:10.748401Z","times_seen":4807,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:02.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: 8e1c0338898cbf92a83f6306bfca08cf2a026a0dc4a50854ed7f3a9bfa846446\r\nX-Amz-Date: 20251205T161402Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=7c98e355999f682262e0e6e99c5ce4fae945c911bbcc7cead110b15723b3769e\r\nContent-Length: 294\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":294,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDowMi4yODZafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJwYWdlTG9hZFRpbWUiOjMzMDksInJlcXVlc3RUaW1lIjoxODUsInJlbmRlclRpbWUiOjMzMDMsInVhdC1haWQiOiJrOTlhOWhjNmU0ZiJ9Cg==\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:02 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 247\r\nset-cookie: AWSALB=7rtgKs6KS/3LVbf+X47l36ymd0yF1SDrEphQgs+UHswqnvu7G3K2tDELEXu/ZBDt6aLgz93TjpP558WRjFtnvddxIsHLN23sF1OgEiOWAF2gSRZ88f0e9MCn/TQC; Expires=Fri, 12 Dec 2025 16:14:02 GMT; Path=/\nAWSALBCORS=7rtgKs6KS/3LVbf+X47l36ymd0yF1SDrEphQgs+UHswqnvu7G3K2tDELEXu/ZBDt6aLgz93TjpP558WRjFtnvddxIsHLN23sF1OgEiOWAF2gSRZ88f0e9MCn/TQC; Expires=Fri, 12 Dec 2025 16:14:02 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: Ps1MYla9pv6CFsduVqge9zTV21Wn7Cipcg05XUA8L9LXIIiq6I26BztefZHVLJ858ws/q/7YSbo0j5io3LcGdcebsbdsEdsI\r\nx-amzn-requestid: e12185b7-8297-bd12-808c-82bd725bf364\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"96139584d6ab6002174e487804eab346","sha1":"55473121bc40460e88849be5a46f2cac543f83eb","sha256":"b44d33cd527d08e6e3ebcfa674e2934a9a342fd65dd9fd4400e1e9a8bf3cd5d8","sha512":"f3d9b55bf2342c0ec1740d695b9ee1643333205ed71cabe5973b4080e1296526ea599cab3a85552585091ca21a27862e03413c79f42e2e769933d5b4d89b4c34","ssdeep":"","tlshash":"87d02b8d7845510da5121aa1141b900707118e76870b52dcdd41a10d45153e212ea919","first_seen":"2025-12-05T16:14:56.159336Z","last_seen":"2025-12-05T16:14:56.159336Z","times_seen":1,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.602Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/main.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-1128e0\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1124576,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a5aa0e5c30ea42498ca8f31c5e08f546","sha1":"08cf199f2cc21ab1a674c201daf33104aa9d32f3","sha256":"809531578879c87a51f5c27b6c9f67c078acdd5221ab955bb621e021fa35027f","sha512":"4f281150e00daf215df8ea3bf3e2bb863ca754835747c770ad7f54f3af811619e4654b1f938e9743b876e376ce8fa58f99a35a78a588bfa12c1d8cb26e093f69","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuj:5TE9YBwore2zMvtyH6cP4hSAuj","tlshash":"1f2595ab304476bb0dabd163886b754530f1723a349a40987a3ca5dedb74d482d63f3b","first_seen":"2025-11-14T10:26:53.493166Z","last_seen":"2025-12-09T02:51:27.0778Z","times_seen":31,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 59600\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-e8d0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59600,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 59600, version 1.0","md5":"e78dce533ecee30c5efd812bb23c248d","sha1":"87d988c2f0343952ccded7c17b000e33db6f3d15","sha256":"03e2544599e5a06566b2579f82ac6e445b724435fccb1f3e8988e58f45b1fc5e","sha512":"84ef89585b92b235ce6d0288f2a52cd894a074bf23c29e06927ad7e3a5316bd97069b69a5246acd1d9eb6beb42b85866a1109d9591300746f11c515d959d82b8","ssdeep":"1536:OOgE9AeA+6fIVtMLSaRUArskS2m21Cgbv+M7+Do/N1:AE5A+6ksSaRPAHw0ov","tlshash":"4543f1155519c890cd26783c89b9aee180b06eb4c2480ef76f9c3685fee1767f6137a4","first_seen":"2023-04-06T18:57:36Z","last_seen":"2026-08-15T08:57:10.748401Z","times_seen":4807,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/vendors.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-35dacb\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3529419,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"53eb9a138f1fa9d1840ad86e451f6451","sha1":"9d2d62cff0a0093ed1c6079eb8a3a6c8d484936a","sha256":"05dd81a0c4f64eca247e1ce31abe05d198657573989526f602b5cb7340cd5a39","sha512":"098a4967977d30a6a268267f28e853951b80ad469738f14fe1b3e8dbf39e682929abe4d231eaf6347e188886204a9f88070f7581e565e4809a5530da2e26482f","ssdeep":"24576:H9Ey0LKZDaJXZgjFUTxjD0MczXwVfNmld:6y8KZDaEexjD0MczXwVfNmld","tlshash":"762529c932c2b47257e352e9807f0106f33a1859744d8468b7acd8de78b994da23bf79","first_seen":"2025-11-14T10:26:53.480723Z","last_seen":"2026-07-12T12:58:11.620842Z","times_seen":159,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/notifier/global.js?1764197486 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:51:26 GMT\r\netag: W/\"6927846e-47cf\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18383,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18319)","md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/favicon.svg?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/favicon.svg?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 634\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-27a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":634,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3db793b2c015d7c858962cd0d8e6df16","sha1":"4ff02cb7383ec6ccfa2f40aa98e8a0367d59233f","sha256":"a3226d3734644e6cee2791e42f6cdb81df5a773b39177bfcf00618961628dd1f","sha512":"7ce8d6eb9670d1b5fb81e3ea6877f20856f3c9ee6b6af5cf340bb10d2d87dfc3fd6b8e2eac5754d9423a2edeaa3da009b7d205bf50eaf634d411a686cdf7f273","ssdeep":"","tlshash":"8bf0a2e11764b18d89990f75df3c7aa4491d74f9724c04d1b68c4c64708faf9ed81e80","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.750052Z","times_seen":2180,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.721Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/vendors.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-35dacb\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3529419,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"53eb9a138f1fa9d1840ad86e451f6451","sha1":"9d2d62cff0a0093ed1c6079eb8a3a6c8d484936a","sha256":"05dd81a0c4f64eca247e1ce31abe05d198657573989526f602b5cb7340cd5a39","sha512":"098a4967977d30a6a268267f28e853951b80ad469738f14fe1b3e8dbf39e682929abe4d231eaf6347e188886204a9f88070f7581e565e4809a5530da2e26482f","ssdeep":"24576:H9Ey0LKZDaJXZgjFUTxjD0MczXwVfNmld:6y8KZDaEexjD0MczXwVfNmld","tlshash":"762529c932c2b47257e352e9807f0106f33a1859744d8468b7acd8de78b994da23bf79","first_seen":"2025-11-14T10:26:53.480723Z","last_seen":"2026-07-12T12:58:11.620842Z","times_seen":159,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.730Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.js?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2d8\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":728,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"resource_available":true,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.min.js?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-a317f\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":668031,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35872)","md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:16.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=u94aksFgrSxM4vVKhsczBAyWg+b4aSuUcloEH02jFWAyyvhagwE9s8qRX/jlgvThO2o+uTrYYpPRim7FtW48WL0W0d2VzK61sdBZ0qPJ13Jzfv+Ag5dmvaYSTXWY; Expires=Fri, 12 Dec 2025 16:14:16 GMT; Path=/\nAWSALBCORS=u94aksFgrSxM4vVKhsczBAyWg+b4aSuUcloEH02jFWAyyvhagwE9s8qRX/jlgvThO2o+uTrYYpPRim7FtW48WL0W0d2VzK61sdBZ0qPJ13Jzfv+Ag5dmvaYSTXWY; Expires=Fri, 12 Dec 2025 16:14:16 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: d36a5078-e706-717e-b2c7-5760f3476843\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sentry.io/api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0","fqdn":"sentry.io","domain":"sentry.io","tld":"io"},"ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sentry.io","organization":"Sentry"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 24 Jul 2025 00:00:00 GMT","end":"Mon, 24 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"40:5D:97:97:7A:AA:2D:23:D7:21:D1:D4:EF:2E:3B:0D:50:F0:11:3C","sha256":"F3:73:7A:50:D7:AC:5C:4F:8E:94:6B:EC:E0:EA:D2:F8:6F:EE:EA:F8:DF:BA:97:5D:92:0E:ED:DA:82:D9:6D:BA"}}},"request":{"raw":"POST /api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0 HTTP/1.1\r\nHost: sentry.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://wi6ndloch0bei.sbs/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 140\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":140,"data":"{}\n{\"type\":\"client_report\"}\n{\"timestamp\":1764951255.679,\"discarded_events\":[{\"reason\":\"sample_rate\",\"category\":\"transaction\",\"quantity\":1}]}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\nx-envoy-upstream-service-time: 0\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-16T17:31:46.359709Z","times_seen":761639,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/prototype.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-17aba\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96954,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60866)","md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/images/symbols.svg?5310351284e83529c337","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.552Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/images/symbols.svg?5310351284e83529c337 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 293514\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-47a8a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":293514,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"13a2b6b7ab9d753b87dc8584ad418766","sha1":"a637bef5d57bc3ac8de7aded3670fcaabfba2af4","sha256":"425be4b5813254f9c6527b0517ad2a1ca1cdf1a7cd571d384d53e38f1ff05fb2","sha512":"5e91c733baef20a3889aeaa273823a07353af6105bc2efb0982c449bcfbc57e6b49f004e203530b0a7032c15a5ce042aef5056805b454794d2f01505269980bf","ssdeep":"3072:4GRcF7g4ZJCXpGpocUcl9solpswLwL67M7YgXCzgPbvy3i8kUrUPxcucvKYj9com:4GmJC6ULCzykhp3aZ","tlshash":"b25453b907ac86dc6257c63aef3b55e4a71e90bf71f5c0a038af97720b63011d5876a0","first_seen":"2025-06-09T20:24:31.20113Z","last_seen":"2026-07-24T10:14:24.348453Z","times_seen":951,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:00.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 303 See Other\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nlocation: https://wi6ndloch0bei.sbs:443/login.php\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"303","status_text":"See Other","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":51,"dns":1,"connect":20,"send":0,"wait":39,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs/","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.css?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-35628\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":218664,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"97d777ac0a73bb162d0f77d4e4bb59b1","sha1":"a9d32eb52df1cafb80dd1dcf3d2f8be2d864e9ac","sha256":"8b6054d89b60e016a1b2ff7b637f824d331032d7b727be78b6beb822a9df780c","sha512":"f5740c64bdd81010b49d046b4edd7534211e95d877108a0f0c95c9974b2dff660d70ddb99f086a8a70939c6632100942abc3390e0a4b4346937eeacdd1e36bfa","ssdeep":"1536:I7452pSu1uRu61m0bzZRa80CpGoGWGqW40K3N2pb/db9m:IoXZRaZd9m","tlshash":"8e2462d1e540353a3e0fb7b971f1a9ac62086981ce52dbdef098e30d86c16d3c9e6d19","first_seen":"2025-11-14T10:26:53.469702Z","last_seen":"2026-07-12T12:58:11.534822Z","times_seen":174,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.601Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/vendors.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-35dacb\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3529419,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"53eb9a138f1fa9d1840ad86e451f6451","sha1":"9d2d62cff0a0093ed1c6079eb8a3a6c8d484936a","sha256":"05dd81a0c4f64eca247e1ce31abe05d198657573989526f602b5cb7340cd5a39","sha512":"098a4967977d30a6a268267f28e853951b80ad469738f14fe1b3e8dbf39e682929abe4d231eaf6347e188886204a9f88070f7581e565e4809a5530da2e26482f","ssdeep":"24576:H9Ey0LKZDaJXZgjFUTxjD0MczXwVfNmld:6y8KZDaEexjD0MczXwVfNmld","tlshash":"762529c932c2b47257e352e9807f0106f33a1859744d8468b7acd8de78b994da23bf79","first_seen":"2025-11-14T10:26:53.480723Z","last_seen":"2026-07-12T12:58:11.620842Z","times_seen":159,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.793Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=DN0flv+E2Zi+r7kRjD1DoE4eSfK+PIbbSDXvXGB0RoMfRK9YTGCYJ7SIIpQecGMvmj3HEUwYx0b7xf60QNn+nJwRIpAblCt8USJh1JZWZJogQEyoAmhSdFQ8YgOZ; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/\nAWSALBCORS=DN0flv+E2Zi+r7kRjD1DoE4eSfK+PIbbSDXvXGB0RoMfRK9YTGCYJ7SIIpQecGMvmj3HEUwYx0b7xf60QNn+nJwRIpAblCt8USJh1JZWZJogQEyoAmhSdFQ8YgOZ; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: cff13eb4-035b-5984-ae5c-39b95d90bac8\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 59600\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-e8d0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59600,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 59600, version 1.0","md5":"e78dce533ecee30c5efd812bb23c248d","sha1":"87d988c2f0343952ccded7c17b000e33db6f3d15","sha256":"03e2544599e5a06566b2579f82ac6e445b724435fccb1f3e8988e58f45b1fc5e","sha512":"84ef89585b92b235ce6d0288f2a52cd894a074bf23c29e06927ad7e3a5316bd97069b69a5246acd1d9eb6beb42b85866a1109d9591300746f11c515d959d82b8","ssdeep":"1536:OOgE9AeA+6fIVtMLSaRUArskS2m21Cgbv+M7+Do/N1:AE5A+6ksSaRPAHw0ov","tlshash":"4543f1155519c890cd26783c89b9aee180b06eb4c2480ef76f9c3685fee1767f6137a4","first_seen":"2023-04-06T18:57:36Z","last_seen":"2026-08-15T08:57:10.748401Z","times_seen":4807,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/require.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-4559\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17753,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17551)","md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"resource_available":true,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/favicon.svg?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/favicon.svg?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:01 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 634\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-27a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":634,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3db793b2c015d7c858962cd0d8e6df16","sha1":"4ff02cb7383ec6ccfa2f40aa98e8a0367d59233f","sha256":"a3226d3734644e6cee2791e42f6cdb81df5a773b39177bfcf00618961628dd1f","sha512":"7ce8d6eb9670d1b5fb81e3ea6877f20856f3c9ee6b6af5cf340bb10d2d87dfc3fd6b8e2eac5754d9423a2edeaa3da009b7d205bf50eaf634d411a686cdf7f273","ssdeep":"","tlshash":"8bf0a2e11764b18d89990f75df3c7aa4491d74f9724c04d1b68c4c64708faf9ed81e80","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.750052Z","times_seen":2180,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.css?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.css?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2a4\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":676,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"50186bab48df0fb765c5e62893fcf211","sha1":"5dafe8f3b22fbb0776758d7ab6c81b47c68d119a","sha256":"f1b7502665bd7cb890a9d0d3f7d0aa377b7adfbb03f9f8101a2aca3cfa3532fc","sha512":"c7a8cf632c28a059ea865f67075e3559bce1a459a97f1529e7a5d67da03c82a65c035eaf32f819f0463702c62fab6d0fb90bc5eb1bc91fe126be185756e4b9de","ssdeep":"","tlshash":"dc019e62d7672cce7a1590691f64c742631c681fc015d72dfad8f65c4f8b054fa32762","first_seen":"2023-04-06T01:25:59Z","last_seen":"2026-08-15T08:57:10.763248Z","times_seen":2348,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/require.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-4559\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17753,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17551)","md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.865Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/main.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-1128e0\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1124576,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a5aa0e5c30ea42498ca8f31c5e08f546","sha1":"08cf199f2cc21ab1a674c201daf33104aa9d32f3","sha256":"809531578879c87a51f5c27b6c9f67c078acdd5221ab955bb621e021fa35027f","sha512":"4f281150e00daf215df8ea3bf3e2bb863ca754835747c770ad7f54f3af811619e4654b1f938e9743b876e376ce8fa58f99a35a78a588bfa12c1d8cb26e093f69","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuj:5TE9YBwore2zMvtyH6cP4hSAuj","tlshash":"1f2595ab304476bb0dabd163886b754530f1723a349a40987a3ca5dedb74d482d63f3b","first_seen":"2025-11-14T10:26:53.493166Z","last_seen":"2025-12-09T02:51:27.0778Z","times_seen":31,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/main.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-1128e0\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1124576,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a5aa0e5c30ea42498ca8f31c5e08f546","sha1":"08cf199f2cc21ab1a674c201daf33104aa9d32f3","sha256":"809531578879c87a51f5c27b6c9f67c078acdd5221ab955bb621e021fa35027f","sha512":"4f281150e00daf215df8ea3bf3e2bb863ca754835747c770ad7f54f3af811619e4654b1f938e9743b876e376ce8fa58f99a35a78a588bfa12c1d8cb26e093f69","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuj:5TE9YBwore2zMvtyH6cP4hSAuj","tlshash":"1f2595ab304476bb0dabd163886b754530f1723a349a40987a3ca5dedb74d482d63f3b","first_seen":"2025-11-14T10:26:53.493166Z","last_seen":"2025-12-09T02:51:27.0778Z","times_seen":31,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/apple-touch-icon.png?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/apple-touch-icon.png?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 4528\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-11b0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4528,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ebbd61fb584cc8ae62ffa726070c952f","sha1":"7aefbffc866e859207b23f736faeac97f51414e6","sha256":"b23ec702f16e22329aa8d8a74cede38c886e609acd467517a004439cbbb1da1c","sha512":"f25e44b2827d8131d7264ac6d89c1da95b452111d92f8681b001145283cd505b7fc72f637b72d94a550247284f15d9334f4e4b8802e795378c8c6483ae68fb73","ssdeep":"96:LSlwpX/RP3oYm4HoZtygi8U/q8fDdOY0JkLTRR6U5/3:LSlwJ/RP3oYmJW7t1Dd0wTz6Uh","tlshash":"fe919e6c5303d6786bf82488136e65e5d24a76627c5397b60ea41b1e2cdc38afbc5cf0","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.747482Z","times_seen":2664,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.256Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.283Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 59600\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-e8d0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59600,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 59600, version 1.0","md5":"e78dce533ecee30c5efd812bb23c248d","sha1":"87d988c2f0343952ccded7c17b000e33db6f3d15","sha256":"03e2544599e5a06566b2579f82ac6e445b724435fccb1f3e8988e58f45b1fc5e","sha512":"84ef89585b92b235ce6d0288f2a52cd894a074bf23c29e06927ad7e3a5316bd97069b69a5246acd1d9eb6beb42b85866a1109d9591300746f11c515d959d82b8","ssdeep":"1536:OOgE9AeA+6fIVtMLSaRUArskS2m21Cgbv+M7+Do/N1:AE5A+6ksSaRPAHw0ov","tlshash":"4543f1155519c890cd26783c89b9aee180b06eb4c2480ef76f9c3685fee1767f6137a4","first_seen":"2023-04-06T18:57:36Z","last_seen":"2026-08-15T08:57:10.748401Z","times_seen":4807,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 2728\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-aa8\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2728,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9360d7ea139bd99ace88e0b99ec9429f","sha1":"542ed6c0c25874845c57a2701340eb327e926458","sha256":"372daa2218a79b1c3ccc8f83cd3f2ac98ce624a7c50e9478f997b631468c6bd0","sha512":"42c1d9ca33d2c188c87eb56b861feca28ec42eb699d5c3ba94a50dde40be3345f1eb09e3c5d792a3e4fc5b300a56b32719f75020b5e5c1881f79fd9fe0f134a5","ssdeep":"","tlshash":"e05167f71330c35c84cba4baef3ae944920ee47dbba34681829ed61468c3995f607954","first_seen":"2023-05-08T09:08:30Z","last_seen":"2026-08-15T08:57:10.752992Z","times_seen":1982,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/notifier/global.js?1764197486 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:51:26 GMT\r\netag: W/\"6927846e-47cf\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18383,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18319)","md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.431Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.min.js?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-a317f\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":668031,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35872)","md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.css?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-35628\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":218664,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"97d777ac0a73bb162d0f77d4e4bb59b1","sha1":"a9d32eb52df1cafb80dd1dcf3d2f8be2d864e9ac","sha256":"8b6054d89b60e016a1b2ff7b637f824d331032d7b727be78b6beb822a9df780c","sha512":"f5740c64bdd81010b49d046b4edd7534211e95d877108a0f0c95c9974b2dff660d70ddb99f086a8a70939c6632100942abc3390e0a4b4346937eeacdd1e36bfa","ssdeep":"1536:I7452pSu1uRu61m0bzZRa80CpGoGWGqW40K3N2pb/db9m:IoXZRaZd9m","tlshash":"8e2462d1e540353a3e0fb7b971f1a9ac62086981ce52dbdef098e30d86c16d3c9e6d19","first_seen":"2025-11-14T10:26:53.469702Z","last_seen":"2026-07-12T12:58:11.534822Z","times_seen":174,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=MJd7EoIiUNw73GEXCS3/Ak1918XFXf1kxa59clmqOuCap74XKyE9RLOiVwiAkG8KPMkrq579LoUc6btFjfNMfT2QhFWdMhQTbz+BRrQqVWG28oVMpEFW+LfahRwC; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/\nAWSALBCORS=MJd7EoIiUNw73GEXCS3/Ak1918XFXf1kxa59clmqOuCap74XKyE9RLOiVwiAkG8KPMkrq579LoUc6btFjfNMfT2QhFWdMhQTbz+BRrQqVWG28oVMpEFW+LfahRwC; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: e6dcf940-2edf-279d-8771-fe51b4e526b0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":214,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/require.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-4559\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17753,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17551)","md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.css?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.css?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2a4\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":676,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"50186bab48df0fb765c5e62893fcf211","sha1":"5dafe8f3b22fbb0776758d7ab6c81b47c68d119a","sha256":"f1b7502665bd7cb890a9d0d3f7d0aa377b7adfbb03f9f8101a2aca3cfa3532fc","sha512":"c7a8cf632c28a059ea865f67075e3559bce1a459a97f1529e7a5d67da03c82a65c035eaf32f819f0463702c62fab6d0fb90bc5eb1bc91fe126be185756e4b9de","ssdeep":"","tlshash":"dc019e62d7672cce7a1590691f64c742631c681fc015d72dfad8f65c4f8b054fa32762","first_seen":"2023-04-06T01:25:59Z","last_seen":"2026-08-15T08:57:10.763248Z","times_seen":2348,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sentry.io/api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0","fqdn":"sentry.io","domain":"sentry.io","tld":"io"},"ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sentry.io","organization":"Sentry"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 24 Jul 2025 00:00:00 GMT","end":"Mon, 24 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"40:5D:97:97:7A:AA:2D:23:D7:21:D1:D4:EF:2E:3B:0D:50:F0:11:3C","sha256":"F3:73:7A:50:D7:AC:5C:4F:8E:94:6B:EC:E0:EA:D2:F8:6F:EE:EA:F8:DF:BA:97:5D:92:0E:ED:DA:82:D9:6D:BA"}}},"request":{"raw":"POST /api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0 HTTP/1.1\r\nHost: sentry.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://wi6ndloch0bei.sbs/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 431\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":431,"data":"{\"sent_at\":\"2025-12-05T16:14:01.672Z\",\"sdk\":{\"name\":\"sentry.javascript.browser\",\"version\":\"10.22.0\"}}\n{\"type\":\"session\"}\n{\"sid\":\"f122665769bc4bf5a0042ad5c92038a7\",\"init\":true,\"started\":\"2025-12-05T16:14:01.672Z\",\"timestamp\":\"2025-12-05T16:14:01.672Z\",\"status\":\"ok\",\"errors\":0,\"attrs\":{\"release\":\"18.0.74.2\",\"environment\":\"production\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:01 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\nx-envoy-upstream-service-time: 1\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-16T17:31:46.359709Z","times_seen":761639,"resource_available":true,"data":null}},"time_used":336,"timings":{"blocked":92,"dns":1,"connect":25,"send":0,"wait":151,"receive":0,"ssl":64},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/prototype.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-17aba\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96954,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60866)","md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=3dIzoUQVcoKazfjgtaYQYHM+aPIkCAuVb26aHHI5re3RpRj/8C/v876tVtOqn1Jmv4D2t3ezvBjDqOlqPjL6WxuAcqADP3Ya3DplV84NK+4gaPzx9CKM3zLFakp5; Expires=Fri, 12 Dec 2025 16:14:17 GMT; Path=/\nAWSALBCORS=3dIzoUQVcoKazfjgtaYQYHM+aPIkCAuVb26aHHI5re3RpRj/8C/v876tVtOqn1Jmv4D2t3ezvBjDqOlqPjL6WxuAcqADP3Ya3DplV84NK+4gaPzx9CKM3zLFakp5; Expires=Fri, 12 Dec 2025 16:14:17 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: f245624c-f4e5-6ff3-93e8-655553c74f0a\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 61548\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-f06c\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61548,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 61548, version 1.0","md5":"e9681ca3d29d814a5621d4764dd1a11e","sha1":"bbda68459fc0531b915bdf9e524ecc8f782db0aa","sha256":"51f0bacf9e49a400a5a2947ef6b14127ef3241b0760d97721e0aedd7add66456","sha512":"f03e8536b40002c4aceb759f4e3cce90277491e4ed1b0d9c3b061d36efe8328545765e2d391a22bdd1e1d3d1e94e50ad4b18f65339c6ee0d22c02316869d808c","ssdeep":"768:/h88uQaIKMZe9H1M8KzcxRsmUYwKDSJIVeOFd+h63Lm18JXdHEAfeckzRA7Hi8:/hFSFMU9YImWvKQ2ikabi8","tlshash":"a753f1b07b32e55bfec639739a6d6311d2135c6e8b0705f642b8a050263f12babc459b","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.761911Z","times_seen":3555,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sentry.io/api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0","fqdn":"sentry.io","domain":"sentry.io","tld":"io"},"ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sentry.io","organization":"Sentry"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 24 Jul 2025 00:00:00 GMT","end":"Mon, 24 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"40:5D:97:97:7A:AA:2D:23:D7:21:D1:D4:EF:2E:3B:0D:50:F0:11:3C","sha256":"F3:73:7A:50:D7:AC:5C:4F:8E:94:6B:EC:E0:EA:D2:F8:6F:EE:EA:F8:DF:BA:97:5D:92:0E:ED:DA:82:D9:6D:BA"}}},"request":{"raw":"POST /api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0 HTTP/1.1\r\nHost: sentry.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://wi6ndloch0bei.sbs/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 140\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":140,"data":"{}\n{\"type\":\"client_report\"}\n{\"timestamp\":1764951248.003,\"discarded_events\":[{\"reason\":\"sample_rate\",\"category\":\"transaction\",\"quantity\":1}]}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\nx-envoy-upstream-service-time: 1\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-16T17:31:46.359709Z","times_seen":761639,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:11.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"POST /login_up.php HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 95\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":95,"data":"login_name=\u0026passwd=\u0026locale_id=default\u0026forgery_protection_token=ecd4cc12e5951f393d5cf8806f81a715"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: text/html; charset=utf-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:11 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"RequireJS","description":"RequireJS is a JavaScript library and file loader which manages the dependencies between JavaScript files and in modular programming.","website":"https://requirejs.org","common_platform_enumeration":"","icon":"RequireJS.svg","categories":["JavaScript frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Prototype","description":"Prototype is a JavaScript Framework that aims to ease development of web applications.","website":"https://www.prototypejs.org","common_platform_enumeration":"cpe:2.3:a:prototypejs:prototype:*:*:*:*:*:*:*:*","icon":"Prototype.png","categories":["JavaScript frameworks"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62506)","md5":"801e6b8ee053cbc51dfaf8aeb214af0f","sha1":"54b8f78ce7068c04e7cb327c6ce0987ea4f1a301","sha256":"e6ac1d2cfd65a970aa3ee1855ada221bc86f03fbedb2e337b4464b2455617eff","sha512":"3c8883385bc4d6792fdb2ef758bd1ce8cb17a79b85035e831242389af9009b4f8f37a106151f72070697d0851d041c22a3a205c475b414fb3898342987285c6c","ssdeep":"1536:esEmNSPKkr2OIyto6j2Z7nm6xzw2fMZwrDpO/oM:esEmNSPK00B6jc7nRmwrDnM","tlshash":"2f93f60909243f3b07cb23f67c9b358dbab491d0a1d85054a9ee846913eef9dd42f16b","first_seen":"2025-12-05T16:14:56.163082Z","last_seen":"2025-12-05T16:14:56.163082Z","times_seen":1,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:15.548Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"POST /login_up.php HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 95\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":95,"data":"login_name=\u0026passwd=\u0026locale_id=default\u0026forgery_protection_token=d8a6ea2ef78517f6b00235ee183ef422"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: text/html; charset=utf-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:15 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Prototype","description":"Prototype is a JavaScript Framework that aims to ease development of web applications.","website":"https://www.prototypejs.org","common_platform_enumeration":"cpe:2.3:a:prototypejs:prototype:*:*:*:*:*:*:*:*","icon":"Prototype.png","categories":["JavaScript frameworks"]},{"name":"RequireJS","description":"RequireJS is a JavaScript library and file loader which manages the dependencies between JavaScript files and in modular programming.","website":"https://requirejs.org","common_platform_enumeration":"","icon":"RequireJS.svg","categories":["JavaScript frameworks"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62506)","md5":"cf2cd3637c64a2927c2ba96cfc86e969","sha1":"fbd8694c6aa59e753ae066a6e45052ecd0b17d68","sha256":"8d7e50fab583fda1ff62cbfb0c701c8ce7e8212c9b9ecad9b14e1ac78210df14","sha512":"58ba21b6d79a0d4036a7f156c7f29dac9cf58a4b9054f0a7b5b503fb5e20bb3b69e78c292c8e77e5257d410bf9d7feba2d7c48a14221b91c045398bf88394d46","ssdeep":"1536:JsEmNSPKkr2OIyto6j2Z7nm6xzw2fMZwrDpO/oM:JsEmNSPK00B6jc7nRmwrDnM","tlshash":"a293f60909243f3b07cb23f67c9b358dbab491d0a1d85054a9ee846913eef9dd42f16b","first_seen":"2025-12-05T16:14:56.163915Z","last_seen":"2025-12-05T16:14:56.163915Z","times_seen":1,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.css?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.857Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.css?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2a4\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":676,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"50186bab48df0fb765c5e62893fcf211","sha1":"5dafe8f3b22fbb0776758d7ab6c81b47c68d119a","sha256":"f1b7502665bd7cb890a9d0d3f7d0aa377b7adfbb03f9f8101a2aca3cfa3532fc","sha512":"c7a8cf632c28a059ea865f67075e3559bce1a459a97f1529e7a5d67da03c82a65c035eaf32f819f0463702c62fab6d0fb90bc5eb1bc91fe126be185756e4b9de","ssdeep":"","tlshash":"dc019e62d7672cce7a1590691f64c742631c681fc015d72dfad8f65c4f8b054fa32762","first_seen":"2023-04-06T01:25:59Z","last_seen":"2026-08-15T08:57:10.763248Z","times_seen":2348,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.min.js?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-a317f\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":668031,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35872)","md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: 5cb5ea9490e245e930909ecb5beaf49847ad451a9f1e13fb9b5bfb4ab0764b4f\r\nX-Amz-Date: 20251205T161416Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=3232c00a82122d58efb5f15b83714a501cd6d4c83917021c458e8d4d5b3a8366\r\nContent-Length: 218\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDoxNi44OTVafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJ1YXQtYWlkIjoiazk5YTloYzZlNGYifQo=\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 246\r\nset-cookie: AWSALB=UuVDnXcxCLGFzEFKWkBqU/W5UbPlS03236NS/4dY6LpsnX6jMI11c73nsXuC+zqxziKdEa9CZC5RipEvQNCCV65fm808+Qow7htdhcgcmKnIm50NxQ8IvryUJmhx; Expires=Fri, 12 Dec 2025 16:14:17 GMT; Path=/\nAWSALBCORS=UuVDnXcxCLGFzEFKWkBqU/W5UbPlS03236NS/4dY6LpsnX6jMI11c73nsXuC+zqxziKdEa9CZC5RipEvQNCCV65fm808+Qow7htdhcgcmKnIm50NxQ8IvryUJmhx; Expires=Fri, 12 Dec 2025 16:14:17 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: lwuMFG93Vr1XEwd0JnM29st3AwYEUtPRirvCKAxLIqkC514vgwh/SnOhbQEPXSOpmOQWoFj9/MFLxqkfdyxexo/GrBqbfftY\r\nx-amzn-requestid: e46cc97d-8e6f-b96b-85c1-ce6477c49d12\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"3715ae2e0873d0425efd7ca2933b677e","sha1":"e21bb1cbe74da331cefdbce5b061104f3257b017","sha256":"d89087eb8a71e16c718049de076cc73b2a0bb3c472915379ccfa691b86f1b446","sha512":"1d5ba960b05957ab36f1fe6582027f89d38d1d679a1e65c3d77be6dec812cb984a227fad52f97bf438e3b2d2ea0f444cdb596bacedca3a43e94fd20421a413f7","ssdeep":"","tlshash":"aed095931f1d2ef90a0d7b778460a204445fbdf8be01144f45483043d1732e064fc4ea","first_seen":"2025-12-05T16:14:56.164675Z","last_seen":"2025-12-05T16:14:56.164675Z","times_seen":1,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.548Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: b2a39d58c15005a78ed5f125abfdd0cbcb0e356f1cba56b71bfc307e98266b05\r\nX-Amz-Date: 20251205T161417Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=515eb97d42ee1abf63c5bd2561de99fc4a0a2bd4e165ab29d2378b9546bb191e\r\nContent-Length: 294\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":294,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDoxNy4zNzRafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJwYWdlTG9hZFRpbWUiOjE4MzIsInJlcXVlc3RUaW1lIjoxMjUsInJlbmRlclRpbWUiOjE2OTEsInVhdC1haWQiOiJrOTlhOWhjNmU0ZiJ9Cg==\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 245\r\nset-cookie: AWSALB=RcvVyek7YA7gUrYlhpqFP7rRKr0TRMWR+mAEAmoXIm73UXtbmvSCsqID1SDmMDFV4wrhbFU7BkJ8mzikE37u85WLYBMZtKH5W8Gk0fnQEx0C6d4jWNSWsungyZ/R; Expires=Fri, 12 Dec 2025 16:14:17 GMT; Path=/\nAWSALBCORS=RcvVyek7YA7gUrYlhpqFP7rRKr0TRMWR+mAEAmoXIm73UXtbmvSCsqID1SDmMDFV4wrhbFU7BkJ8mzikE37u85WLYBMZtKH5W8Gk0fnQEx0C6d4jWNSWsungyZ/R; Expires=Fri, 12 Dec 2025 16:14:17 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: YP3WJSKCYtPfhrGLLH3yDmJt8r4qngJOvrouGogz9lT9GqMzvo3hhIFZbxTEeTPoZ75xMPip3U1yhZtFsejTk6sB7Hqysl0P\r\nx-amzn-requestid: dfbb9033-349f-773c-be16-972a671b7c68\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"8b1016dca3c75759b83c04cbe34e7cc9","sha1":"fb2667562904d3a2affc7e174496fdfd04bfc094","sha256":"ef17f016238eb4ec402922384af22fa3a87d56b3d88d189a1f60518bde1b37b5","sha512":"46d78153825e91d314efaa080785987cf14f09eee2a5440ba3d41dd4d3cafae1f315e06e0de65494375c9473392ffd452e7facab797cb305311ddb6ae9b801f2","ssdeep":"","tlshash":"2dd0954836d47ce0f6435b5258470a3623375b31d23417dd435d447d24c2cc1945c201","first_seen":"2025-12-05T16:14:56.165494Z","last_seen":"2025-12-05T16:14:56.165494Z","times_seen":1,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.min.js?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-a317f\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":668031,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35872)","md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"resource_available":true,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:02.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:02 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=KsYYvL8W/ILdz7IVP0FRQRcU9ZnDb85amFDGq1fCPJw9cMhMSOD5eRoQcz0RAp4zjHpLj+s1DvX1I/ddMrbk3Sk9n/r2tRgZzbq3Yhw49JiWdccBDAwvMzFNP0+3; Expires=Fri, 12 Dec 2025 16:14:02 GMT; Path=/\nAWSALBCORS=KsYYvL8W/ILdz7IVP0FRQRcU9ZnDb85amFDGq1fCPJw9cMhMSOD5eRoQcz0RAp4zjHpLj+s1DvX1I/ddMrbk3Sk9n/r2tRgZzbq3Yhw49JiWdccBDAwvMzFNP0+3; Expires=Fri, 12 Dec 2025 16:14:02 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: cf853b24-51a4-ebf9-ae28-3c2ed08d872e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:13:58.835Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":116,"timings":{"blocked":0,"dns":0,"connect":20,"send":0,"wait":0,"receive":0,"ssl":93},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs/","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-regular.woff2?e7777b3c2bb7ae4d50f3 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 59600\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-e8d0\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59600,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 59600, version 1.0","md5":"e78dce533ecee30c5efd812bb23c248d","sha1":"87d988c2f0343952ccded7c17b000e33db6f3d15","sha256":"03e2544599e5a06566b2579f82ac6e445b724435fccb1f3e8988e58f45b1fc5e","sha512":"84ef89585b92b235ce6d0288f2a52cd894a074bf23c29e06927ad7e3a5316bd97069b69a5246acd1d9eb6beb42b85866a1109d9591300746f11c515d959d82b8","ssdeep":"1536:OOgE9AeA+6fIVtMLSaRUArskS2m21Cgbv+M7+Do/N1:AE5A+6ksSaRPAHw0ov","tlshash":"4543f1155519c890cd26783c89b9aee180b06eb4c2480ef76f9c3685fee1767f6137a4","first_seen":"2023-04-06T18:57:36Z","last_seen":"2026-08-15T08:57:10.748401Z","times_seen":4807,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":120,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 61548\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-f06c\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61548,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 61548, version 1.0","md5":"e9681ca3d29d814a5621d4764dd1a11e","sha1":"bbda68459fc0531b915bdf9e524ecc8f782db0aa","sha256":"51f0bacf9e49a400a5a2947ef6b14127ef3241b0760d97721e0aedd7add66456","sha512":"f03e8536b40002c4aceb759f4e3cce90277491e4ed1b0d9c3b061d36efe8328545765e2d391a22bdd1e1d3d1e94e50ad4b18f65339c6ee0d22c02316869d808c","ssdeep":"768:/h88uQaIKMZe9H1M8KzcxRsmUYwKDSJIVeOFd+h63Lm18JXdHEAfeckzRA7Hi8:/hFSFMU9YImWvKQ2ikabi8","tlshash":"a753f1b07b32e55bfec639739a6d6311d2135c6e8b0705f642b8a050263f12babc459b","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.761911Z","times_seen":3555,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.min.js?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.min.js?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-a317f\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":668031,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35872)","md5":"2c61240871ced47d10a1a5cca750d21d","sha1":"ffe729aae5dd3fd6f4e80deba92d66721666ee71","sha256":"1acc5fd6a19ac604efe28f81ddcb77f7afaffe235d10f8acfbbcb91d60b7223a","sha512":"5d9047cc20a5d1796aba911f8d6aa343beb93a4f9876051dc3f70e306e2421de1b8ede6fe37faafd24c9d94849450d06009d09c06f2c0d3822e0d2431367ff9b","ssdeep":"12288:rSCo4wMqDBljvm6tP4c7pwNRymCNqNpDXqsYKCUWx:rSCo4QPpcRoNI1XEgWx","tlshash":"e8e44c9070c1f4e916f744d6406f5409b23a1d29e40e5ca0beb8eccd25ba85a717bfbe","first_seen":"2025-11-14T10:26:53.483683Z","last_seen":"2026-07-12T12:58:11.585469Z","times_seen":158,"resource_available":true,"data":null}},"time_used":101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.js?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2d8\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":728,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: ab6cd581eef6194e421ee7321f0ea18446b067a3dc5b3930632727b19c6370eb\r\nX-Amz-Date: 20251205T161409Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=f3ba8ed8ad88b132be897865c2d9ea6b8697c41e685032ae1bd83a484fc60bc6\r\nContent-Length: 218\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDowOS4wNjdafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJ1YXQtYWlkIjoiazk5YTloYzZlNGYifQo=\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 247\r\nset-cookie: AWSALB=W95PMf/Ehk6bOWTp9qDIQec5V++ifgV4Dv4oCuhbh3A6ggosmeFrYxkfuYO/7cVx5KdDXjpSiXuvkMJ6uPycI98JLzqM871am1gUOCY019Rs9wnmv1BAxL6Oassx; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/\nAWSALBCORS=W95PMf/Ehk6bOWTp9qDIQec5V++ifgV4Dv4oCuhbh3A6ggosmeFrYxkfuYO/7cVx5KdDXjpSiXuvkMJ6uPycI98JLzqM871am1gUOCY019Rs9wnmv1BAxL6Oassx; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: tRGd0gTVj5PtT5Av7gCYKg5xLpDkqTeq8R8IeidvgwFg9JIHJzx+1Seh+Jcy11DD8m0b8K344snCkIV0PiOQVKPDW/23UaEI\r\nx-amzn-requestid: ce2c0c16-df61-8061-af81-0b075b7c241a\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"8ec2e202bac69efa8678a5e6985eecab","sha1":"3edcb5abc841188e1204e376a21965cae54d1f2b","sha256":"42eb7c85f8184d1df1ec4cce9a3d7ed7917b3d3aa5fe7c753a3afbbc72d9e552","sha512":"093d02621e6c7a5369c58df4b855992d051bcba5c760307959f55e84d34727e3240521ab330c6dfdf507423fd568d9e27b4c38624d3e909b2592db21e4440aa6","ssdeep":"","tlshash":"12d0955a3d5d327cb005117fa359c61f5c943c171b054ff96e2b402d29c9160017d714","first_seen":"2025-12-05T16:14:56.166359Z","last_seen":"2025-12-05T16:14:56.166359Z","times_seen":1,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":161,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.274Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 2728\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-aa8\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2728,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9360d7ea139bd99ace88e0b99ec9429f","sha1":"542ed6c0c25874845c57a2701340eb327e926458","sha256":"372daa2218a79b1c3ccc8f83cd3f2ac98ce624a7c50e9478f997b631468c6bd0","sha512":"42c1d9ca33d2c188c87eb56b861feca28ec42eb699d5c3ba94a50dde40be3345f1eb09e3c5d792a3e4fc5b300a56b32719f75020b5e5c1881f79fd9fe0f134a5","ssdeep":"","tlshash":"e05167f71330c35c84cba4baef3ae944920ee47dbba34681829ed61468c3995f607954","first_seen":"2023-05-08T09:08:30Z","last_seen":"2026-08-15T08:57:10.752992Z","times_seen":1982,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/css/main.css?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.856Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/css/main.css?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-58500\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":361728,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d7c3779b2d402d9c673a54173b96f22d","sha1":"ead0d04187ae89fff3723744403dba7329b8919a","sha256":"6f631cb20e1b72e4d1419801d0f041459bea3f1792e60af6e73e2fd2c8428bcf","sha512":"9e5fe3069f4e837222f3211010be4c7fd1a1a8df936defa86897cc94f239c3fd11aa2f2fba93e410c21659f216817a524c7f91b1a974b674bac8fe788fd2827f","ssdeep":"6144:S6USCdHO33ag+Y3iniVRV2Du88Sag88Sbut:cHOviispt","tlshash":"1c743d50f05931bd766b872af3e12645a31e9461e2525ffff46bf2acc2c90c41633a26","first_seen":"2025-11-14T10:26:53.473414Z","last_seen":"2026-07-12T12:58:11.592189Z","times_seen":126,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:12.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=5kppAcmpT3Tkx+PzKrLC8yD+ON7YnanFAryAql82tSPDzyaU2bEZOx8T1lR5fEV/TPaI1ybwAphOAzKeNbt+yWwSXr7kgQCxFIEX2oCYfi8h/O7DRPY3FWW+irdq; Expires=Fri, 12 Dec 2025 16:14:12 GMT; Path=/\nAWSALBCORS=5kppAcmpT3Tkx+PzKrLC8yD+ON7YnanFAryAql82tSPDzyaU2bEZOx8T1lR5fEV/TPaI1ybwAphOAzKeNbt+yWwSXr7kgQCxFIEX2oCYfi8h/O7DRPY3FWW+irdq; Expires=Fri, 12 Dec 2025 16:14:12 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: eefa5beb-9f37-4a97-8f57-5cff6be08dc1\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":172,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/notifier/global.js?1764197486 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:51:26 GMT\r\netag: W/\"6927846e-47cf\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18383,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18319)","md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"resource_available":true,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: e1799161e53b46f13c09efcb74016c9935c67290e7bbf63bf35f302a0cefa080\r\nX-Amz-Date: 20251205T161405Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=4633aa12ce26e72d65311c8778779aa8433f47d0ca86677a5718ba1c40dec085\r\nContent-Length: 294\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":294,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDowNS43NDhafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJwYWdlTG9hZFRpbWUiOjE0ODcsInJlcXVlc3RUaW1lIjoxMjQsInJlbmRlclRpbWUiOjEzNTMsInVhdC1haWQiOiJrOTlhOWhjNmU0ZiJ9Cg==\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:06 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 245\r\nset-cookie: AWSALB=B59DCXHqlshJ5dKXqeooZYTzNPrSWy97O02+4R3RUSQ3+aOJzpK1ArN2LBpj93LttH5tIaiC6Cd+b81OAowW1rWnG/H3lPcXzTScfejthAUdubwNut/X7XiSvwLA; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/\nAWSALBCORS=B59DCXHqlshJ5dKXqeooZYTzNPrSWy97O02+4R3RUSQ3+aOJzpK1ArN2LBpj93LttH5tIaiC6Cd+b81OAowW1rWnG/H3lPcXzTScfejthAUdubwNut/X7XiSvwLA; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: eMXnvtTRcBfta8x097247WvBWPjB95pJo/yMBF9o/P4xU5HwtOGI5bqBeFjNBpBswD3Ztw3EpEk1UJw43gnbQoZaeRMzAwRH\r\nx-amzn-requestid: dd76fa75-f812-6d52-bcdb-fd7b7c0fc929\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"9feb4141a93d649e030242c10f9f514c","sha1":"58ec2d0ce674878ad30fba8f20656cdcbe9d096c","sha256":"c7f2bbfdab875cc22651dfc05c03ac1ff918d1949b12ac5f5573da64deddcea5","sha512":"74fc31cb6919fc20a9d352a9978b29c42b265fa39ddc9f6a58f42d002833da5008d8882cacc1b53d4c4c6a0bbb249f10f23fe83089c3468cadd23438c8816b87","ssdeep":"","tlshash":"d7d02b1076e00189a711ea618d14a274409b2f07e2a2e13991e5d489150506c12a021d","first_seen":"2025-12-05T16:14:56.167071Z","last_seen":"2025-12-05T16:14:56.167071Z","times_seen":1,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.282Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 61548\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-f06c\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61548,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 61548, version 1.0","md5":"e9681ca3d29d814a5621d4764dd1a11e","sha1":"bbda68459fc0531b915bdf9e524ecc8f782db0aa","sha256":"51f0bacf9e49a400a5a2947ef6b14127ef3241b0760d97721e0aedd7add66456","sha512":"f03e8536b40002c4aceb759f4e3cce90277491e4ed1b0d9c3b061d36efe8328545765e2d391a22bdd1e1d3d1e94e50ad4b18f65339c6ee0d22c02316869d808c","ssdeep":"768:/h88uQaIKMZe9H1M8KzcxRsmUYwKDSJIVeOFd+h63Lm18JXdHEAfeckzRA7Hi8:/hFSFMU9YImWvKQ2ikabi8","tlshash":"a753f1b07b32e55bfec639739a6d6311d2135c6e8b0705f642b8a050263f12babc459b","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.761911Z","times_seen":3555,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.js?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2d8\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":728,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sentry.io/api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0","fqdn":"sentry.io","domain":"sentry.io","tld":"io"},"ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.326Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sentry.io","organization":"Sentry"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 24 Jul 2025 00:00:00 GMT","end":"Mon, 24 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"40:5D:97:97:7A:AA:2D:23:D7:21:D1:D4:EF:2E:3B:0D:50:F0:11:3C","sha256":"F3:73:7A:50:D7:AC:5C:4F:8E:94:6B:EC:E0:EA:D2:F8:6F:EE:EA:F8:DF:BA:97:5D:92:0E:ED:DA:82:D9:6D:BA"}}},"request":{"raw":"POST /api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0 HTTP/1.1\r\nHost: sentry.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://wi6ndloch0bei.sbs/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 431\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":431,"data":"{\"sent_at\":\"2025-12-05T16:14:05.312Z\",\"sdk\":{\"name\":\"sentry.javascript.browser\",\"version\":\"10.22.0\"}}\n{\"type\":\"session\"}\n{\"sid\":\"657b05a12874425db5fdc8660b75dc36\",\"init\":true,\"started\":\"2025-12-05T16:14:05.311Z\",\"timestamp\":\"2025-12-05T16:14:05.311Z\",\"status\":\"ok\",\"errors\":0,\"attrs\":{\"release\":\"18.0.74.2\",\"environment\":\"production\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\nx-envoy-upstream-service-time: 1\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-16T17:31:46.359709Z","times_seen":761639,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":137,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/notifier/global.js?1764197486","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/notifier/global.js?1764197486 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:51:26 GMT\r\netag: W/\"6927846e-47cf\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18383,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (18319)","md5":"d490c52f6633dd26bf3a46b713c3e0c6","sha1":"c492c36f30698f69d9d8215f8f7c975312f5a5cf","sha256":"1a81d8c8f3ba066c179b646d4dc7a9906fa8b4f24e69a532869cc98018165a25","sha512":"82a73bef8268fd611dbd6f460cc33234d74d81bb6b620a7eee63b660fd1f321d12e6ee0ffe46625fa771d5669f675101ef147626f17bf2252cca83e34c7f81fc","ssdeep":"384:aiozAyMWa+5d0yicAoyQCdLEC8h8kpcmAnB2:jozvRJziXXQCdLEC8hKnB2","tlshash":"3682a7dd70e3e4ec13eb726d60dfd209797b0d09d809b582e659d4e17868a82d123f2e","first_seen":"2025-09-19T02:59:45.797163Z","last_seen":"2026-08-14T20:02:09.377208Z","times_seen":1233,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sentry.io/api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0","fqdn":"sentry.io","domain":"sentry.io","tld":"io"},"ip":{"addr":"35.186.247.156","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sentry.io","organization":"Sentry"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 24 Jul 2025 00:00:00 GMT","end":"Mon, 24 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"40:5D:97:97:7A:AA:2D:23:D7:21:D1:D4:EF:2E:3B:0D:50:F0:11:3C","sha256":"F3:73:7A:50:D7:AC:5C:4F:8E:94:6B:EC:E0:EA:D2:F8:6F:EE:EA:F8:DF:BA:97:5D:92:0E:ED:DA:82:D9:6D:BA"}}},"request":{"raw":"POST /api/1327420/envelope/?sentry_version=7\u0026sentry_key=50365a6fe24f4ff28f6b625410e04a35\u0026sentry_client=sentry.javascript.browser%2F10.22.0 HTTP/1.1\r\nHost: sentry.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://wi6ndloch0bei.sbs/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 431\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":431,"data":"{\"sent_at\":\"2025-12-05T16:14:09.039Z\",\"sdk\":{\"name\":\"sentry.javascript.browser\",\"version\":\"10.22.0\"}}\n{\"type\":\"session\"}\n{\"sid\":\"e8506ca7d8f04d4c86b648f9855438fc\",\"init\":true,\"started\":\"2025-12-05T16:14:09.038Z\",\"timestamp\":\"2025-12-05T16:14:09.038Z\",\"status\":\"ok\",\"errors\":0,\"attrs\":{\"release\":\"18.0.74.2\",\"environment\":\"production\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}}"}},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nvary: origin, access-control-request-method, access-control-request-headers\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-sentry-error,x-sentry-rate-limits,retry-after\r\ncross-origin-resource-policy: cross-origin\r\nx-envoy-upstream-service-time: 1\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-16T17:31:46.359709Z","times_seen":761639,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/main.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-1128e0\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1124576,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a5aa0e5c30ea42498ca8f31c5e08f546","sha1":"08cf199f2cc21ab1a674c201daf33104aa9d32f3","sha256":"809531578879c87a51f5c27b6c9f67c078acdd5221ab955bb621e021fa35027f","sha512":"4f281150e00daf215df8ea3bf3e2bb863ca754835747c770ad7f54f3af811619e4654b1f938e9743b876e376ce8fa58f99a35a78a588bfa12c1d8cb26e093f69","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuj:5TE9YBwore2zMvtyH6cP4hSAuj","tlshash":"1f2595ab304476bb0dabd163886b754530f1723a349a40987a3ca5dedb74d482d63f3b","first_seen":"2025-11-14T10:26:53.493166Z","last_seen":"2025-12-09T02:51:27.0778Z","times_seen":31,"resource_available":false,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/images/symbols.svg?5310351284e83529c337","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/images/symbols.svg?5310351284e83529c337 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 293514\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-47a8a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":293514,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"13a2b6b7ab9d753b87dc8584ad418766","sha1":"a637bef5d57bc3ac8de7aded3670fcaabfba2af4","sha256":"425be4b5813254f9c6527b0517ad2a1ca1cdf1a7cd571d384d53e38f1ff05fb2","sha512":"5e91c733baef20a3889aeaa273823a07353af6105bc2efb0982c449bcfbc57e6b49f004e203530b0a7032c15a5ce042aef5056805b454794d2f01505269980bf","ssdeep":"3072:4GRcF7g4ZJCXpGpocUcl9solpswLwL67M7YgXCzgPbvy3i8kUrUPxcucvKYj9com:4GmJC6ULCzykhp3aZ","tlshash":"b25453b907ac86dc6257c63aef3b55e4a71e90bf71f5c0a038af97720b63011d5876a0","first_seen":"2025-06-09T20:24:31.20113Z","last_seen":"2026-07-24T10:14:24.348453Z","times_seen":951,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":71,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:19.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"POST /login_up.php HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 95\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":95,"data":"login_name=\u0026passwd=\u0026locale_id=default\u0026forgery_protection_token=f72216e08974e04d8dd4e3846b903da1"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:19 GMT\r\ncontent-type: text/html; charset=utf-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:19 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Prototype","description":"Prototype is a JavaScript Framework that aims to ease development of web applications.","website":"https://www.prototypejs.org","common_platform_enumeration":"cpe:2.3:a:prototypejs:prototype:*:*:*:*:*:*:*:*","icon":"Prototype.png","categories":["JavaScript frameworks"]},{"name":"RequireJS","description":"RequireJS is a JavaScript library and file loader which manages the dependencies between JavaScript files and in modular programming.","website":"https://requirejs.org","common_platform_enumeration":"","icon":"RequireJS.svg","categories":["JavaScript frameworks"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62506)","md5":"3e774c6f0e6e39d937ccaa5a3065c675","sha1":"3ec1fa8843b87f7446a484bfd724ff29d58b0609","sha256":"70bc161d5ab145724b045f1defa94588202f7d2b6e5874cb2feb620ef3ba2a2b","sha512":"0518c70f12c526e1e842c6629f5f12763e36e854a3989f0c1a08fb60a2a75ca1a44ccfeb5b9c7d7c155c50e5eb7bbe129eb62c3d9a5b94f0432397ab030b04c7","ssdeep":"1536:2sEmNSPKkr2OIyto6j2Z7nm6xzw2fMZwrDpO/oM:2sEmNSPK00B6jc7nRmwrDnM","tlshash":"1d93f60909243f3b07cb23f67c9b358dbab491d0a1d8505469ee846913eef9dd42f16b","first_seen":"2025-12-05T16:14:56.167745Z","last_seen":"2025-12-05T16:14:56.167745Z","times_seen":1,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.598Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/prototype.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-17aba\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96954,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60866)","md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.css?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-35628\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":218664,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"97d777ac0a73bb162d0f77d4e4bb59b1","sha1":"a9d32eb52df1cafb80dd1dcf3d2f8be2d864e9ac","sha256":"8b6054d89b60e016a1b2ff7b637f824d331032d7b727be78b6beb822a9df780c","sha512":"f5740c64bdd81010b49d046b4edd7534211e95d877108a0f0c95c9974b2dff660d70ddb99f086a8a70939c6632100942abc3390e0a4b4346937eeacdd1e36bfa","ssdeep":"1536:I7452pSu1uRu61m0bzZRa80CpGoGWGqW40K3N2pb/db9m:IoXZRaZd9m","tlshash":"8e2462d1e540353a3e0fb7b971f1a9ac62086981ce52dbdef098e30d86c16d3c9e6d19","first_seen":"2025-11-14T10:26:53.469702Z","last_seen":"2026-07-12T12:58:11.534822Z","times_seen":174,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: dd38714508418abe38a1194ed99c70118da44417994fa4e7faacfa3b7fc9f082\r\nX-Amz-Date: 20251205T161405Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=3c70642782436bc278351ad6d61790e42d026202949cdbd0fbbab9a369bea7a4\r\nContent-Length: 218\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDowNS4zNDRafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJ1YXQtYWlkIjoiazk5YTloYzZlNGYifQo=\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 246\r\nset-cookie: AWSALB=PqFxCELA672/jtBNdzrgGMdyNBslCK99u8HOTexPnQB6a07UOicBH3/IqdLgZ8nwPwpaDHajjvKoTJhfGmBWrOo7YVOI74vb/RF9M+vBIvHExT5ZNaIHOJ/UkbGF; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/\nAWSALBCORS=PqFxCELA672/jtBNdzrgGMdyNBslCK99u8HOTexPnQB6a07UOicBH3/IqdLgZ8nwPwpaDHajjvKoTJhfGmBWrOo7YVOI74vb/RF9M+vBIvHExT5ZNaIHOJ/UkbGF; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: 4qWE3lcZ0S8GQ2qmBQbf47JGbngpiAnnFpP8RuMBOTxsVaFL0gDLGp7d570D0rH4BUaNIqVTSUdheTQt2aQjwsEFQgMmll4C\r\nx-amzn-requestid: d7541a04-5c35-f52e-b6f9-1d09d8285155\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"7ae138f1b3f2f773e405679822ab9713","sha1":"132e1714964b246b2ed8c5bb495f3a907f97d57b","sha256":"c43c0a770ea81643f3e85223095374ac8f329867c7d2110ee59c8759ac0a283b","sha512":"f1b26bb3bec37a96a05a919c73038d55746b6bc45bfc348938501c2f7ba68a5bc43bb53d8a04b5d90b5325ee9e86e4ef70138a4fc3300c7b8580f80d317d5833","ssdeep":"","tlshash":"f1d02b0129ca9ec13404a6d57165a425c8145c3a2b4f7b1c461c5062584f465cc02e05","first_seen":"2025-12-05T16:14:56.168558Z","last_seen":"2025-12-05T16:14:56.168558Z","times_seen":1,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.854Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.css?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-35628\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":218664,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"97d777ac0a73bb162d0f77d4e4bb59b1","sha1":"a9d32eb52df1cafb80dd1dcf3d2f8be2d864e9ac","sha256":"8b6054d89b60e016a1b2ff7b637f824d331032d7b727be78b6beb822a9df780c","sha512":"f5740c64bdd81010b49d046b4edd7534211e95d877108a0f0c95c9974b2dff660d70ddb99f086a8a70939c6632100942abc3390e0a4b4346937eeacdd1e36bfa","ssdeep":"1536:I7452pSu1uRu61m0bzZRa80CpGoGWGqW40K3N2pb/db9m:IoXZRaZd9m","tlshash":"8e2462d1e540353a3e0fb7b971f1a9ac62086981ce52dbdef098e30d86c16d3c9e6d19","first_seen":"2025-11-14T10:26:53.469702Z","last_seen":"2026-07-12T12:58:11.534822Z","times_seen":174,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.547Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: 23a19156c90a4f0a1924781ba04991bae61fa1904b884f739ad8966a525812a1\r\nX-Amz-Date: 20251205T161413Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=f5b57026b330d69547a6d75b8f701abfd9a5ccdb2cf9381c6cf380d446929dbb\r\nContent-Length: 294\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":294,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDoxMy4zMTRafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJwYWdlTG9hZFRpbWUiOjE2MzgsInJlcXVlc3RUaW1lIjoxMTgsInJlbmRlclRpbWUiOjE1MDIsInVhdC1haWQiOiJrOTlhOWhjNmU0ZiJ9Cg==\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 246\r\nset-cookie: AWSALB=XYvSCmKjpGqWpRZkbexFI2aIL6fvZSt8Zy6Xnwbk34u2xvB+uOOaD8LjiISwwFgMtBksmYRenlDOh0EpKcEf9Jq2AVorfm55iZ2ToXZPvi6mHe38Bu/x77FQ8V0K; Expires=Fri, 12 Dec 2025 16:14:13 GMT; Path=/\nAWSALBCORS=XYvSCmKjpGqWpRZkbexFI2aIL6fvZSt8Zy6Xnwbk34u2xvB+uOOaD8LjiISwwFgMtBksmYRenlDOh0EpKcEf9Jq2AVorfm55iZ2ToXZPvi6mHe38Bu/x77FQ8V0K; Expires=Fri, 12 Dec 2025 16:14:13 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: B3C0UWiCaM/W4hbKeXsPdacrHtXThX63aAj9jGaGdT2exydS1FQfkjXsN/5E+lpM3FT8mol9AMylebDOPbHNEghEfH0gD4z3\r\nx-amzn-requestid: f4184c10-4abe-acef-95b5-4b0524169653\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"7fb5475cd8d75851de41a2ba3258d7d4","sha1":"bc35d9cb5b09e21d7484d9cceb41d6beccdbebd0","sha256":"ede52b6768fe02c7ce467584d8ecc568dbe7f684132562745f982ad6b9419997","sha512":"60b3df5385b2cd54260d1d74cba98dddbf4cb718b1c5d351fad874eb4d7852bb0104204db4baf63b060ee277f47efceb566e50015fc97478254abba3894a7323","ssdeep":"","tlshash":"36d02b941b07555eb24775a0a02116060614ca67ee40752eb21ab15901a56c4a175e29","first_seen":"2025-12-05T16:14:56.16939Z","last_seen":"2025-12-05T16:14:56.16939Z","times_seen":1,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"POST / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Amz-User-Agent: aws-sdk-js/2.1692.0 callback\r\nContent-Type: application/x-amz-json-1.1\r\nX-Amz-Target: Firehose_20150804.PutRecord\r\nX-Amz-Content-Sha256: 823ef80e5060a46a158283bfa9185728f0394467117508dfd1021c571e1345f5\r\nX-Amz-Date: 20251205T161412Z\r\nAuthorization: AWS4-HMAC-SHA256 Credential=00000000000000000000/20251205/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=35eb856b2cebf1e86ebaf9abc995c072317d5c3648a35da5a4d517388668bc46\r\nContent-Length: 218\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"{\"DeliveryStreamName\":\"plesk-18.0-ux-no_session\",\"Record\":{\"Data\":\"MjAyNS0xMi0wNVQxNjoxNDoxMi44MzZafDc3QkQuNEEwQy45NzNBLjQwMjAuQURCQS45QzBELkY3NUIuRjk1Mnx8fHwvbG9naW5fdXAucGhwfHx8eyJ1YXQtYWlkIjoiazk5YTloYzZlNGYifQo=\"}}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: application/x-amz-json-1.1\r\ncontent-length: 245\r\nset-cookie: AWSALB=/nmQ3GMwWVygr+HkO8Nfa2EIqDBoBum45jv0otwR2MuqnD9FLCahs6/qmUF38KT7WAfuqPQXuXQW6Kqrchxv1X4K1fHvaQ5kmk6rfTUgM1f/MZYDme26kChZN2xK; Expires=Fri, 12 Dec 2025 16:14:13 GMT; Path=/\nAWSALBCORS=/nmQ3GMwWVygr+HkO8Nfa2EIqDBoBum45jv0otwR2MuqnD9FLCahs6/qmUF38KT7WAfuqPQXuXQW6Kqrchxv1X4K1fHvaQ5kmk6rfTUgM1f/MZYDme26kChZN2xK; Expires=Fri, 12 Dec 2025 16:14:13 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\ncontent-encoding: gzip\r\nx-amz-id-2: UWNer852s/6hc04BMr1+KIFgh8FnUaoI7x1rJ6zzrqliYL+XxD5lVEuluxA89aXW1lzCdqzk+GaaTn/fo+MMrmzJ0mcqFYYk\r\nx-amzn-requestid: f8068e5a-1dcd-b000-99ab-894fa29fa8bd\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]}],"data":{"size":257,"size_decoded":0,"mime_type":"application/x-amz-json-1.1","magic":"JSON text data","md5":"e92adbeaf0dfd9812a64cbe22832fbcc","sha1":"a37bcee89a7304473eca207bbd39531d9e9e4ec4","sha256":"b977c7d514c153ed071893fafa75ad98b13065b96bd7fc1652daa774fd38056e","sha512":"10819a0233ca58d9ff4fff346a3bfa662e972bcae3e0b3395786f8a066d1c112982b7d33d7973ca2cb376fd973ce54594b71caed5ef9ea0e9520e1076ee1d04b","ssdeep":"","tlshash":"edd02b6435ea8906e12301c398460c024875f855030cb01f490a24df879799585a30c3","first_seen":"2025-12-05T16:14:56.170175Z","last_seen":"2025-12-05T16:14:56.170175Z","times_seen":1,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.css?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:00.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.css?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:00 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2a4\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":676,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"50186bab48df0fb765c5e62893fcf211","sha1":"5dafe8f3b22fbb0776758d7ab6c81b47c68d119a","sha256":"f1b7502665bd7cb890a9d0d3f7d0aa377b7adfbb03f9f8101a2aca3cfa3532fc","sha512":"c7a8cf632c28a059ea865f67075e3559bce1a459a97f1529e7a5d67da03c82a65c035eaf32f819f0463702c62fab6d0fb90bc5eb1bc91fe126be185756e4b9de","ssdeep":"","tlshash":"dc019e62d7672cce7a1590691f64c742631c681fc015d72dfad8f65c4f8b054fa32762","first_seen":"2023-04-06T01:25:59Z","last_seen":"2026-08-15T08:57:10.763248Z","times_seen":2348,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.430Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/prototype.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-17aba\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96954,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60866)","md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.434Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/require.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-4559\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17753,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17551)","md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=pHe2O7PmRRc/lGTGvyOUGuH4mMdsd0W85HnF0viW0Ksqtn1vGPmswjor4R606bTY6qTrJiLBrXisPaePK4ZinaHZXParlzIDvjpjgXdA2DrzDw667JxLjauw31w5; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/\nAWSALBCORS=pHe2O7PmRRc/lGTGvyOUGuH4mMdsd0W85HnF0viW0Ksqtn1vGPmswjor4R606bTY6qTrJiLBrXisPaePK4ZinaHZXParlzIDvjpjgXdA2DrzDw667JxLjauw31w5; Expires=Fri, 12 Dec 2025 16:14:05 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: cda79562-4434-6c96-ac0a-926f4727ba64\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":152,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/vendors.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/vendors.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-35dacb\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3529419,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"53eb9a138f1fa9d1840ad86e451f6451","sha1":"9d2d62cff0a0093ed1c6079eb8a3a6c8d484936a","sha256":"05dd81a0c4f64eca247e1ce31abe05d198657573989526f602b5cb7340cd5a39","sha512":"098a4967977d30a6a268267f28e853951b80ad469738f14fe1b3e8dbf39e682929abe4d231eaf6347e188886204a9f88070f7581e565e4809a5530da2e26482f","ssdeep":"24576:H9Ey0LKZDaJXZgjFUTxjD0MczXwVfNmld:6y8KZDaEexjD0MczXwVfNmld","tlshash":"762529c932c2b47257e352e9807f0106f33a1859744d8468b7acd8de78b994da23bf79","first_seen":"2025-11-14T10:26:53.480723Z","last_seen":"2026-07-12T12:58:11.620842Z","times_seen":159,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/favicon.svg?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/favicon.svg?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 634\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-27a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":634,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3db793b2c015d7c858962cd0d8e6df16","sha1":"4ff02cb7383ec6ccfa2f40aa98e8a0367d59233f","sha256":"a3226d3734644e6cee2791e42f6cdb81df5a773b39177bfcf00618961628dd1f","sha512":"7ce8d6eb9670d1b5fb81e3ea6877f20856f3c9ee6b6af5cf340bb10d2d87dfc3fd6b8e2eac5754d9423a2edeaa3da009b7d205bf50eaf634d411a686cdf7f273","ssdeep":"","tlshash":"8bf0a2e11764b18d89990f75df3c7aa4491d74f9724c04d1b68c4c64708faf9ed81e80","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.750052Z","times_seen":2180,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:09.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:09 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=AXZR9kdE7HcEFBVKGPM16ts5cuUPEg+SjpOfXRvUTK/5QpG840Q5kQUb9ucLvzG0Ptgw28vT1Nz2derQK2wRKGVpARy0Aqg91Tzvo9YjauWkoN0/3hrHGahWXkTI; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/\nAWSALBCORS=AXZR9kdE7HcEFBVKGPM16ts5cuUPEg+SjpOfXRvUTK/5QpG840Q5kQUb9ucLvzG0Ptgw28vT1Nz2derQK2wRKGVpARy0Aqg91Tzvo9YjauWkoN0/3hrHGahWXkTI; Expires=Fri, 12 Dec 2025 16:14:09 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: e9b1bb53-cddf-58f9-881c-bc4294797cc2\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=zWRrDyHXgEUGDuAc/xTcD4CzVicNi/phdVX70Vz9vfa9MugV9rkehEd7zZU6j0Mg7ZW9C7cM2vlV2grjIxi/icg2vt4pxJF9ljhnXc9dcETMqPUjXstHs6fGne+K; Expires=Fri, 12 Dec 2025 16:14:13 GMT; Path=/\nAWSALBCORS=zWRrDyHXgEUGDuAc/xTcD4CzVicNi/phdVX70Vz9vfa9MugV9rkehEd7zZU6j0Mg7ZW9C7cM2vlV2grjIxi/icg2vt4pxJF9ljhnXc9dcETMqPUjXstHs6fGne+K; Expires=Fri, 12 Dec 2025 16:14:13 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: d37c3a76-14bf-8c06-b2d1-3d632eccfaf8\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":153,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":152,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.css?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:08.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.css?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2a4\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":676,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"50186bab48df0fb765c5e62893fcf211","sha1":"5dafe8f3b22fbb0776758d7ab6c81b47c68d119a","sha256":"f1b7502665bd7cb890a9d0d3f7d0aa377b7adfbb03f9f8101a2aca3cfa3532fc","sha512":"c7a8cf632c28a059ea865f67075e3559bce1a459a97f1529e7a5d67da03c82a65c035eaf32f819f0463702c62fab6d0fb90bc5eb1bc91fe126be185756e4b9de","ssdeep":"","tlshash":"dc019e62d7672cce7a1590691f64c742631c681fc015d72dfad8f65c4f8b054fa32762","first_seen":"2023-04-06T01:25:59Z","last_seen":"2026-08-15T08:57:10.763248Z","times_seen":2348,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uat-proxy.plesk.com/","fqdn":"uat-proxy.plesk.com","domain":"plesk.com","tld":"com"},"ip":{"addr":"52.19.116.147","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:01.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"uat-proxy.plesk.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Fri, 01 Aug 2025 00:00:00 GMT","end":"Sun, 30 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:5B:6C:B7:19:D1:F4:7B:E1:8C:07:D2:A7:7E:84:36:29:07:F3:07","sha256":"4B:46:37:E8:81:F5:46:5D:48:54:2D:9C:36:A9:A2:1E:0E:BC:41:8C:54:04:8B:05:56:7D:21:4A:77:E1:C7:59"}}},"request":{"raw":"OPTIONS / HTTP/1.1\r\nHost: uat-proxy.plesk.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\nReferer: https://wi6ndloch0bei.sbs/\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 05 Dec 2025 16:14:02 GMT\r\ncontent-length: 20\r\nset-cookie: AWSALB=lShIVSw7TDwi1V7B6RDfNhDlb8p1k/mxta6awcKdFONg8G/UMtGA1IZr/oIuPXZFBFBHxnYwMjMoPwrvPYaSHFhTcTWGrFZs/Rewb+ifUNc0LbhAqoyp2hWCfYKM; Expires=Fri, 12 Dec 2025 16:14:01 GMT; Path=/\nAWSALBCORS=lShIVSw7TDwi1V7B6RDfNhDlb8p1k/mxta6awcKdFONg8G/UMtGA1IZr/oIuPXZFBFBHxnYwMjMoPwrvPYaSHFhTcTWGrFZs/Rewb+ifUNc0LbhAqoyp2hWCfYKM; Expires=Fri, 12 Dec 2025 16:14:01 GMT; Path=/; SameSite=None; Secure\r\naccess-control-allow-headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: x-amz-request-id,x-amz-id-2,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date\r\naccess-control-max-age: 172800\r\ncontent-encoding: gzip\r\nx-amzn-requestid: f6decc9a-365a-d525-9773-cb90b97107f1\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon ALB","description":"Amazon Application Load Balancer (ALB) distributes incoming application traffic to increase availability and support content-based routing.","website":"https://aws.amazon.com/elasticloadbalancing/","common_platform_enumeration":"","icon":"Amazon ELB.svg","categories":["Load balancers"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-16T17:31:27.7002Z","times_seen":17921660,"resource_available":true,"data":null}},"time_used":534,"timings":{"blocked":177,"dns":22,"connect":35,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/main.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:04.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/main.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-1128e0\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1124576,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a5aa0e5c30ea42498ca8f31c5e08f546","sha1":"08cf199f2cc21ab1a674c201daf33104aa9d32f3","sha256":"809531578879c87a51f5c27b6c9f67c078acdd5221ab955bb621e021fa35027f","sha512":"4f281150e00daf215df8ea3bf3e2bb863ca754835747c770ad7f54f3af811619e4654b1f938e9743b876e376ce8fa58f99a35a78a588bfa12c1d8cb26e093f69","ssdeep":"6144:5TEqyYkhErw8c2RKiGIe21k/Bi7MKotz2H6cP4hRnQAuj:5TE9YBwore2zMvtyH6cP4hSAuj","tlshash":"1f2595ab304476bb0dabd163886b754530f1723a349a40987a3ca5dedb74d482d63f3b","first_seen":"2025-11-14T10:26:53.493166Z","last_seen":"2025-12-09T02:51:27.0778Z","times_seen":31,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:17.148Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/fonts/open-sans-600.woff2?098c0a7547a49b0ce576 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:17 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 61548\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: \"691db17d-f06c\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61548,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 61548, version 1.0","md5":"e9681ca3d29d814a5621d4764dd1a11e","sha1":"bbda68459fc0531b915bdf9e524ecc8f782db0aa","sha256":"51f0bacf9e49a400a5a2947ef6b14127ef3241b0760d97721e0aedd7add66456","sha512":"f03e8536b40002c4aceb759f4e3cce90277491e4ed1b0d9c3b061d36efe8328545765e2d391a22bdd1e1d3d1e94e50ad4b18f65339c6ee0d22c02316869d808c","ssdeep":"768:/h88uQaIKMZe9H1M8KzcxRsmUYwKDSJIVeOFd+h63Lm18JXdHEAfeckzRA7Hi8:/hFSFMU9YImWvKQ2ikabi8","tlshash":"a753f1b07b32e55bfec639739a6d6311d2135c6e8b0705f642b8a050263f12babc459b","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.761911Z","times_seen":3555,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/modules/letsencrypt/global.js?1764197688","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /modules/letsencrypt/global.js?1764197688 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Nov 2025 22:54:48 GMT\r\netag: W/\"69278538-2d8\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":728,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"736e9873b188ca07579c91f59ca0611b","sha1":"7838cdb3d5e814c9cdf04d0df66d216137a0ef35","sha256":"48a1cf43c9e4eb052dc744098a4af4570f1fb95dacacca06f6140ceb885e2d6c","sha512":"31cb1e20836413215c850eed9a36a17208a0688513d8a02634db7a2121966794d52f713b02bfbe936acb48ab2f7c8510f3d2d7fcdbd605a4d5e2e942ece5f414","ssdeep":"","tlshash":"110184367a9a30ed1b3a9075ca1ee055b620351fa551d521b88ce6190fd07703978af9","first_seen":"2025-04-17T07:43:46.709778Z","last_seen":"2026-08-15T08:57:10.746485Z","times_seen":2067,"resource_available":true,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/theme/images/logos/plesk/logo.svg","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:13.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/theme/images/logos/plesk/logo.svg HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:13 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 2728\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-aa8\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2728,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9360d7ea139bd99ace88e0b99ec9429f","sha1":"542ed6c0c25874845c57a2701340eb327e926458","sha256":"372daa2218a79b1c3ccc8f83cd3f2ac98ce624a7c50e9478f997b631468c6bd0","sha512":"42c1d9ca33d2c188c87eb56b861feca28ec42eb699d5c3ba94a50dde40be3345f1eb09e3c5d792a3e4fc5b300a56b32719f75020b5e5c1881f79fd9fe0f134a5","ssdeep":"","tlshash":"e05167f71330c35c84cba4baef3ae944920ee47dbba34681829ed61468c3995f607954","first_seen":"2023-05-08T09:08:30Z","last_seen":"2026-08-15T08:57:10.752992Z","times_seen":1982,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/images/favicon.svg?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:05.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /images/favicon.svg?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:05 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 634\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: \"6920373c-27a\"\r\nx-content-type-options: nosniff\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":634,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3db793b2c015d7c858962cd0d8e6df16","sha1":"4ff02cb7383ec6ccfa2f40aa98e8a0367d59233f","sha256":"a3226d3734644e6cee2791e42f6cdb81df5a773b39177bfcf00618961628dd1f","sha512":"7ce8d6eb9670d1b5fb81e3ea6877f20856f3c9ee6b6af5cf340bb10d2d87dfc3fd6b8e2eac5754d9423a2edeaa3da009b7d205bf50eaf634d411a686cdf7f273","ssdeep":"","tlshash":"8bf0a2e11764b18d89990f75df3c7aa4491d74f9724c04d1b68c4c64708faf9ed81e80","first_seen":"2023-04-30T18:17:13Z","last_seen":"2026-08-15T08:57:10.750052Z","times_seen":2180,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/prototype.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:11.861Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/prototype.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:11 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-17aba\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96954,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60866)","md5":"7b977fcf623bdf0786a7a642b5060cb4","sha1":"6b278e07ae45a8bcb49bcbdb0202abc6b41cc624","sha256":"fd88cdbcd424715233994f5f3ad361fdc8cc02b5badc6b2474c3fa2a95741057","sha512":"5db52c963a9531a0690dee627b043c5858752d02e2682237afd1c0dfd74ce96ea2c31a2745f98d6e9bc9935a286f857ee5b2f12f37853146c12effb62842c345","ssdeep":"1536:lp8HqTIkDc9+DkfJtPkoQzID5mGgSio6dFlLN4ia1mY60hgPXsQn5ycO64pJ1VLC:5U+D7WL+Xsa05Pi0W","tlshash":"6193d6dc31c2b176439b617a402f614ef23a5d95680e9050f568d8e6bcb8e9b8233f7d","first_seen":"2025-09-09T02:20:02.46182Z","last_seen":"2026-08-15T08:57:10.749192Z","times_seen":1095,"resource_available":true,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/ui-library/plesk-ui-library.css?1763553661","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.714Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /ui-library/plesk-ui-library.css?1763553661 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 19 Nov 2025 12:01:01 GMT\r\netag: W/\"691db17d-35628\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":218664,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"97d777ac0a73bb162d0f77d4e4bb59b1","sha1":"a9d32eb52df1cafb80dd1dcf3d2f8be2d864e9ac","sha256":"8b6054d89b60e016a1b2ff7b637f824d331032d7b727be78b6beb822a9df780c","sha512":"f5740c64bdd81010b49d046b4edd7534211e95d877108a0f0c95c9974b2dff660d70ddb99f086a8a70939c6632100942abc3390e0a4b4346937eeacdd1e36bfa","ssdeep":"1536:I7452pSu1uRu61m0bzZRa80CpGoGWGqW40K3N2pb/db9m:IoXZRaZd9m","tlshash":"8e2462d1e540353a3e0fb7b971f1a9ac62086981ce52dbdef098e30d86c16d3c9e6d19","first_seen":"2025-11-14T10:26:53.469702Z","last_seen":"2026-07-12T12:58:11.534822Z","times_seen":174,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/cp/javascript/externals/require.js?1763718972","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wi6ndloch0bei.sbs/login_up.php","date":"2025-12-05T16:14:15.726Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"GET /cp/javascript/externals/require.js?1763718972 HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:15 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 21 Nov 2025 09:56:12 GMT\r\netag: W/\"6920373c-4559\"\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17753,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17551)","md5":"3edb4f233e8aae8ef670fba6dcd1f4ab","sha1":"f56e4186ede065c605a2b58e7c4185bc978af4a8","sha256":"cf14ee85a07f7a5951826a0e63f6120fb68c6e4e1ab23c85ff7c0f5d75cb5a05","sha512":"cd03dd69c80fdd3729a379e55306c360206c213c5c9a81a29af13c669f063f927075631644ffd8a460b6ea5cf76889caea735df53a29ff0f8e318ce28f938d7f","ssdeep":"384:pv6/1fnN5sMU8Qatweblko9n8VQ/AGGa1PHSEDO1SUyy1AmXMeNshGVW40tI:MfYMU8nblko9n8CY1aJHSEDMNyy13XD5","tlshash":"3182faee3ae6f903b26222f4406f504e5377d953141cc144f619e8f5acb8568a6a3e3c","first_seen":"2025-09-09T02:20:02.456557Z","last_seen":"2026-08-14T06:23:42.57348Z","times_seen":375,"resource_available":true,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wi6ndloch0bei.sbs/login_up.php","fqdn":"wi6ndloch0bei.sbs","domain":"wi6ndloch0bei.sbs","tld":"sbs"},"ip":{"addr":"185.161.251.62","port":443,"asn":215540,"as":"Global Connectivity Solutions Llp","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-05T16:14:04.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exciting-dhawan.185-161-251-62.plesk.page","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 21:56:30 GMT","end":"Tue, 24 Feb 2026 21:56:29 GMT"},"fingerprint":{"sha1":"A8:55:0A:E2:B5:F1:79:44:BF:6D:B5:6C:06:5B:B3:13:E0:73:82:D3","sha256":"8A:B5:3B:4A:7F:4C:6D:F8:BE:9A:E1:2A:B9:B4:24:36:79:D9:B4:74:D7:4E:3E:97:6F:82:85:4E:FF:C3:3F:22"}}},"request":{"raw":"POST /login_up.php HTTP/1.1\r\nHost: wi6ndloch0bei.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 95\r\nOrigin: https://wi6ndloch0bei.sbs\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wi6ndloch0bei.sbs/login_up.php\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":95,"data":"login_name=\u0026passwd=\u0026locale_id=default\u0026forgery_protection_token=ea0a96af75358d1b89970ad438d605c4"}},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 05 Dec 2025 16:14:04 GMT\r\ncontent-type: text/html; charset=utf-8\r\nexpires: Fri, 28 May 1999 00:00:00 GMT\r\nlast-modified: Fri, 05 Dec 2025 16:14:04 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\np3p: CP=\"NON COR CURa ADMa OUR NOR UNI COM NAV STA\"\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Prototype","description":"Prototype is a JavaScript Framework that aims to ease development of web applications.","website":"https://www.prototypejs.org","common_platform_enumeration":"cpe:2.3:a:prototypejs:prototype:*:*:*:*:*:*:*:*","icon":"Prototype.png","categories":["JavaScript frameworks"]},{"name":"RequireJS","description":"RequireJS is a JavaScript library and file loader which manages the dependencies between JavaScript files and in modular programming.","website":"https://requirejs.org","common_platform_enumeration":"","icon":"RequireJS.svg","categories":["JavaScript frameworks"]}],"data":{"size":92057,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (62506)","md5":"d71a3d64470bf1f2f8f86922bb3d0919","sha1":"eeef1d23e62610e5465b07f793a958e544893147","sha256":"3da9494cf7ac7abfb5a52b9882b714a292d3eb57a8b474f2971eff7a575d75b6","sha512":"42e2e82c4e0e03a02f8dd4f15758539f13c93fa36a731ce3ed950f8d765e2e6604c133ecad94be7bec889c27947217db171f7cd976df05b81d09a3fc1b0121d9","ssdeep":"1536:1sEmNSPKkr2OIyto6j2Z7nm6xzw2fMZwrDpO/oM:1sEmNSPK00B6jc7nRmwrDnM","tlshash":"df93f60909243f3b07cb23f67c9b358dbab491d0a1d85054a9ee846913eef9dd42f16b","first_seen":"2025-12-05T16:14:56.170948Z","last_seen":"2025-12-05T16:14:56.170948Z","times_seen":1,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-05","alert":"Phishing Block","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-05","alert":"Phishing - Barclays Bank Plc","trigger":"wi6ndloch0bei.sbs","verdict":"phishing","severity":"medium","comment":"Barclays Bank Plc","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-05","alert":"Sinkholed","trigger":"wi6ndloch0bei.sbs","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}