{"report_id":"3fe7d507-c88d-4dba-b3f0-eeb555dcf53a","version":6,"status":"done","tags":[],"date":"2026-03-18T22:30:27Z","url":{"schema":"https","addr":"atb-online.org","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"atb-online.org/","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"title":"Telegram","dom":{"size":4492,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2860)","md5":"62252a719aad1d13ac7b997e2e3fb5e7","sha1":"388333e1b6b67edfe0fe8def245ddb116f0ed252","sha256":"944c9fa95d988e21c0c8c0259e7142341785bb74c4e365215c4b5df20155550f","sha512":"2088a0396af0d81fde156d050019363764cf284aee0912a099f16af42c5ddca9766143a97aabe12f1d9ff4e5a427b3d35ea59044a06c3a40754fd83742b31fbc","ssdeep":"96:RuPAMLUG+msenSOc+U1Md13poB00JFySPCN:oVQleSN+Umd5CB0DN","tlshash":"659191835b14c84d23218636daf7f088c221c40fd9a9ac80f59552db4ef5ff8d573aa8","dom_hash":"domhash5dd2ad5ff68c6edda57ed80d1bd87536","first_seen":"2026-03-18T22:30:31.650403Z","last_seen":"2026-03-18T22:30:31.650403Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"atb-online.org","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-22T22:30:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-03-18","alert":"Hunting_JS_WebAssembly","trigger":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"atb-online.org","ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-08","domain_rank":0,"first_seen":"2026-03-18T22:30:28.405047Z","last_seen":"2026-03-18T22:30:28.405048Z","alert_count":27,"request_count":23,"received_data":1028953,"sent_data":10398,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"atb-online.org/","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b5e3e64052bada0eceaa6d187c18801a","sha1":"f1fd33355939dab3bd4e6a0e5e091fc38707ed7c","sha256":"d77ae82e302891078ea8978ed38b3f7182a4514624015b44ae58eeb3c09a465c","sha512":"fe96b60e88772e718bf36c5b4141a785377077fac384d25693e6ce2af808567b64c8a2eac13811683a6d1934a904cd2a743def5812b9f0af5708c3377516856e","ssdeep":"","tlshash":"7411638430d19564db9128618aef83086230ca1589cfcac8c562a6c47db838cea22fec","size":1083,"data":"","first_seen":"2026-03-18T22:30:31.660366Z","last_seen":"2026-03-18T22:30:31.660366Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/main.591b17ddb6e56c8911a0.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c1517c9cee9a7840af585c3070ad456f","sha1":"8675892bab5b837b118939944363022690d87128","sha256":"1ea654a57b597476f5c2d6fb795f6d283635f8740cd4eb9b22377bf92d9d4841","sha512":"8b19bce10e3e9349f39f87fe67a076fa513fb02cb6a70f7ae872698fd5fcbe540f47ceb14d6182ddf3321d5559e6061946645829a784855d33523f677ab4f643","ssdeep":"12288:rgSn5dYhZDItfCg4rKLqbLnaLIqQi66KZM6KdW/QuQjv49Hk+EZm94ekHQVIi15s:/nP2ZEfTJ/Ll","tlshash":"e8b43cd571d674ea63e309e6a4ab0098b7395944380dc4a0f16dfce93d364aaa373f4c","size":539843,"data":"","first_seen":"2026-03-05T13:07:53.781931Z","last_seen":"2026-03-30T16:56:15.76718Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/6708.361b8790bb09dcdd0973.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d287655f827a0354f814f947a59c0a01","sha1":"d56ede9bbef7428156a7ffe5879bc46185d1b1da","sha256":"a780555d336615962d0ca7700ae2b0cd418b634f7d99585d6caa9ab02f137930","sha512":"f2d3eaf35054c3c73c8af75a485b41738f6cc40e9d0a628e1139a2c9788fc0117ea2f15ceb31603655073df3983fe469479037aa9b898e1791d41412e4e5d66e","ssdeep":"192:OeIKfyWQPKy61/Za7mBP+WiYUpahWqPBdLKM/GtiV0D1UYc1U:xIwyWFy6XtB+XYUshDPBRKMFY1UYc1U","tlshash":"f012d996a131747e62aa84d5e2100b026a36d5587c09a2bdf73c7cfb2d9640a34bcf7c","size":9393,"data":"","first_seen":"2026-03-05T13:07:53.807239Z","last_seen":"2026-03-30T16:56:15.770027Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/redirect.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"17773b57b87a678c98e26a7cac72df6c","sha1":"7422857aa75ee81cabcec2eed6c4a6168f363ee1","sha256":"375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f","sha512":"28d9e1c2af08154e653e2291db46f4110edbf9f5591192f8d695c8852f9c3c755d69dfb5a032a45f51e0a3fc9417f16c20d0772b1225ca9b85e5531e12fa8bfc","ssdeep":"","tlshash":"e8e07dda0279030417e013f36d82b4709137c2fb604c5d028d984321a1b9b4f5b7b84f","size":325,"data":"","first_seen":"2023-07-27T09:32:34Z","last_seen":"2026-08-11T05:55:54.245741Z","times_seen":11540,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/compatTests.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b1137a70e5094e046802b348818587a6","sha1":"0c1f0f10cb8da14c78ee02a5854f69db53975b11","sha256":"8d0da8170edc28b34c30ef67197035487deefc00600f9762bcaa886ff652f488","sha512":"5e99951d68ec5f1ac8a8ce7950dce81346943f673b4732e66a2a1ea8ec4c704128cfa1ba082ed375b8a669d26d028cddaa3b370b7426af70e0cd64ccfd7e9c86","ssdeep":"","tlshash":"59c08c45d4e007b8a2b100af53473a64a3b20305400ba610e04c0b4c3d74e0f4950ebf","size":164,"data":"","first_seen":"2026-03-18T22:30:31.658172Z","last_seen":"2026-03-18T22:30:31.658172Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/hook.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3674474bff51510b492743cc250936e0","sha1":"3d2dd1bad1b031118d3d149503c13c2195599a09","sha256":"75a56f3e97cdc1a164c3e5fdc461833b51d628bd10d08ebc969457ca8a2c70f4","sha512":"2ae7b634c7bfdc9889a480afa7e5cabb060e6164335ef35f6e5201b5bd60ffcb7f9aee82523716f09971692c042b63c74e9d0eed1d1dc4a19cd5710a3c30b404","ssdeep":"","tlshash":"76312d4c5cd325b5596224708fff0108b1b5c593048fce59b9a8a2807fe0b2cdab5ee9","size":1602,"data":"","first_seen":"2026-03-18T22:30:31.652081Z","last_seen":"2026-03-18T22:30:31.652081Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"atb-online.org/favicon.svg","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:08.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:08 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bvwYFGLcjPI5U0iAaG7cgFARtNi9X7kNkBfR3Q389BrbyB1E9qXHlarfafXJ4ofpQ9Ha%2FhK37IzjMQjSyZi13rTqw4jCaRwFR3scL5Sv\"}]}\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"69b778d7-37c\"\r\ncf-ray: 9de7ae1c891c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":892,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d9ee2d4b0edd9f8ba2fb7242162c2c47","sha1":"398522893cf2cdefb5176f11bc67eab31c2d7382","sha256":"a462f1c5333e16b48335054493cfd1d0a13a96847b4b9ffe2cf24403e6e86010","sha512":"e404678e96fe6f6d1fe6c1390e4a64d90844a2d8903f84f1a34b23137593da5ba04112d9504b8bf480b392b294830a363344c5767e3bb5b7a3cb6f5df2a3aa45","ssdeep":"","tlshash":"97114493d060e71ad4c9e16bef61fca0116720cee5b745d485d95a34500fcdbfc08668","first_seen":"2023-05-09T00:01:39Z","last_seen":"2026-08-11T05:55:54.238794Z","times_seen":15703,"resource_available":false,"data":null}},"time_used":454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":454,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/hook.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:06.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /hook.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:07 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 11:21:26 GMT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\netag: W/\"69b7e7b6-642\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F%2BUwqpyKXkC1LLBVaKUQmQ2w7s8vcSQaH81NefxjvN%2Fp5qYFz%2F5c0ybAXyuibHCjZ5jy4VzNIZI85bj%2Bu9cNfuw1tBnleUbh%2FE5Y%2B4SZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae13df225ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1602,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"3674474bff51510b492743cc250936e0","sha1":"3d2dd1bad1b031118d3d149503c13c2195599a09","sha256":"75a56f3e97cdc1a164c3e5fdc461833b51d628bd10d08ebc969457ca8a2c70f4","sha512":"2ae7b634c7bfdc9889a480afa7e5cabb060e6164335ef35f6e5201b5bd60ffcb7f9aee82523716f09971692c042b63c74e9d0eed1d1dc4a19cd5710a3c30b404","ssdeep":"","tlshash":"76312d4c5cd325b5596224708fff0108b1b5c593048fce59b9a8a2807fe0b2cdab5ee9","first_seen":"2026-03-18T22:30:31.652081Z","last_seen":"2026-03-18T22:30:31.652081Z","times_seen":1,"resource_available":true,"data":null}},"time_used":435,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":434,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/6708.361b8790bb09dcdd0973.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:10.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /6708.361b8790bb09dcdd0973.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\netag: W/\"69b778d7-24b1\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DnqdrjDv5EK14O6DdBAAOHtVcCVr0NvPMQupFIZ4lEgJ9Sp%2B6DFvV31MkIPdqU682geLjxvFMQZNnVR%2F67miiOk2QnnVIQFZu8BKLUy5\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae2dec0d5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9393,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (9339)","md5":"d287655f827a0354f814f947a59c0a01","sha1":"d56ede9bbef7428156a7ffe5879bc46185d1b1da","sha256":"a780555d336615962d0ca7700ae2b0cd418b634f7d99585d6caa9ab02f137930","sha512":"f2d3eaf35054c3c73c8af75a485b41738f6cc40e9d0a628e1139a2c9788fc0117ea2f15ceb31603655073df3983fe469479037aa9b898e1791d41412e4e5d66e","ssdeep":"192:OeIKfyWQPKy61/Za7mBP+WiYUpahWqPBdLKM/GtiV0D1UYc1U:xIwyWFy6XtB+XYUshDPBRKMFY1UYc1U","tlshash":"f012d996a131747e62aa84d5e2100b026a36d5587c09a2bdf73c7cfb2d9640a34bcf7c","first_seen":"2026-03-05T13:07:53.807239Z","last_seen":"2026-03-30T16:56:15.770027Z","times_seen":28,"resource_available":true,"data":null}},"time_used":431,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/6805.122c42ed2dab78b484d5.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:11.313Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /6805.122c42ed2dab78b484d5.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-1cb5\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mbgC%2FYDGUc6A8OfgCJXVxrg7vL3a08sCLf%2BKhYBrIo9EeaksG6RdIScPR8cQOCkco4Z0UhK1AuJYStt9ZlhOBnQ981MFN%2FWd%2BNyYXAAu\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae30ac825ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7349,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (7295)","md5":"7656a1330550a33a5c92d5918440142c","sha1":"4ab41db32fc440c4efe16db8d3549349ccf4fe39","sha256":"ca77ff078741b78d604e9d5111397b96f0bf833c7463e590beb8457aed1d1601","sha512":"6e170851709145915734859060da4546a5af2610fb37c1941da1c7df24c5ea5ebe5e89c2ea9481f0ce439a2e7c02e9fd5a034bbd3562aeb45fcd86c00ea8aeb8","ssdeep":"96:SiW936N68UWhdT7ZqV9aZ+dQupaX976INDgr2Bst41opKWIMAbEzFWbCT960u7J+:SiMq8piPCvDYh6Ej7EYbCT4R9Xbuoq","tlshash":"05e1b4d63752593ee3969dcaad3e1043a0a1d92c39188164772a5ceb3d27dc1e0b2f53","first_seen":"2026-03-05T13:07:53.784783Z","last_seen":"2026-03-30T16:56:15.770545Z","times_seen":28,"resource_available":false,"data":null}},"time_used":419,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":419,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/6805.122c42ed2dab78b484d5.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:11.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /6805.122c42ed2dab78b484d5.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-1cb5\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w4Wq5xBOQCn%2Bc9eB6dmbrvngqUy1TkmwDalYu7MrJ1uzPZBlFelh7dYT%2FpR7ZEBSoJpGrv1CjWMs0n%2F5OLGG16nVkZE3QmoiA4MElLR1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae30bc855ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7349,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (7295)","md5":"7656a1330550a33a5c92d5918440142c","sha1":"4ab41db32fc440c4efe16db8d3549349ccf4fe39","sha256":"ca77ff078741b78d604e9d5111397b96f0bf833c7463e590beb8457aed1d1601","sha512":"6e170851709145915734859060da4546a5af2610fb37c1941da1c7df24c5ea5ebe5e89c2ea9481f0ce439a2e7c02e9fd5a034bbd3562aeb45fcd86c00ea8aeb8","ssdeep":"96:SiW936N68UWhdT7ZqV9aZ+dQupaX976INDgr2Bst41opKWIMAbEzFWbCT960u7J+:SiMq8piPCvDYh6Ej7EYbCT4R9Xbuoq","tlshash":"05e1b4d63752593ee3969dcaad3e1043a0a1d92c39188164772a5ceb3d27dc1e0b2f53","first_seen":"2026-03-05T13:07:53.784783Z","last_seen":"2026-03-30T16:56:15.770545Z","times_seen":28,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/3345.86ef7d5fa6d231350df9.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /3345.86ef7d5fa6d231350df9.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-b2e\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pBYQpjW3W52Tto88lfGXMp36lWg7%2BLwjAfFI9wsCu2P%2Fi2yGaOzY07i5Y5yIY8%2BUoxP5Bh8mud%2BQUOh9Uo5mOTiOiGGEgpfr4ZW9YRfC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae336d0c5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2862,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2808)","md5":"c82fcd023cc92eb737498eb0ac082493","sha1":"264ea08bcf0300c79cb19c7f1c3851fdc3ce052e","sha256":"f4abe2f20e52b200095fb0e37ea7ec1d1048c0c1e3ac70159d6c065e311434c6","sha512":"547f9ff30ac0411a095ef8141713e23e1a9ffd5f5382cacd9f58c2c10fb4af3c10ed899248d7dd3d5fb1fb568d39eb85f80efb2a2f095bbc920a77c5d05890f6","ssdeep":"","tlshash":"05510a482a73387a2c6747abf8573b120d6513b23819f49316199eef8a7724f4b03f49","first_seen":"2026-03-05T13:07:53.773162Z","last_seen":"2026-03-30T16:56:15.765166Z","times_seen":28,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":129,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /rlottie-wasm.b8cd14b929a7127811bd.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:12 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d9-10001\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LhqEZHZNg0oaA%2Fr5FTrKS1B0YIKWFh0jXRVRQ2pFA2vkOYKE4h21S%2FYMZmiqX4qEZMZ8qWb54MJEwB6IuoleinX9awjcs9v9JB7KsPJg\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae345d345ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65537,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f9197a18681b7cc4f51b1911286902b0","sha1":"3f585990b02c98c9d787cb74c2a52fdf5d753b98","sha256":"bed5811a3341e35e206eaf3a0518c50edfe50ee9da37480286ac38ff29813c0d","sha512":"9679389c7ae84ee258a31c28e0da91ca3885c491f3e15e544d04c0bbb73c820e03ef8a834d96be0d29305534b18302f2b0110d9361e1d5f34a0fed38912550cd","ssdeep":"768:O6g4cP2yQ6eO0PDlgTdxHzvszXIn2B1ARnv76AeuFYNYjYxRrqhlr3NKR:O1Q6eOyQ5UzXpmK8y1alr8R","tlshash":"2c53e88535d9b0ab42837878946f310bf1ab6d52681c8410db1dd4dabcb4e49e63ffe8","first_seen":"2025-08-04T01:39:06.738468Z","last_seen":"2026-07-03T22:44:54.827943Z","times_seen":185,"resource_available":true,"data":null}},"time_used":274,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":273,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-03-18","alert":"Hunting_JS_WebAssembly","trigger":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /rlottie-wasm.b8cd14b929a7127811bd.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:12 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d9-10001\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0raebtWyWVgrwN%2BT1txE0qPwJ5C2xs8tpyZBBVJGogLhMjp6oJxABgplIvo%2BVKxLibwF18hi%2BPsxvSeJARvd03R1KKYBpwVn4EZFo0qf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae345d375ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65537,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f9197a18681b7cc4f51b1911286902b0","sha1":"3f585990b02c98c9d787cb74c2a52fdf5d753b98","sha256":"bed5811a3341e35e206eaf3a0518c50edfe50ee9da37480286ac38ff29813c0d","sha512":"9679389c7ae84ee258a31c28e0da91ca3885c491f3e15e544d04c0bbb73c820e03ef8a834d96be0d29305534b18302f2b0110d9361e1d5f34a0fed38912550cd","ssdeep":"768:O6g4cP2yQ6eO0PDlgTdxHzvszXIn2B1ARnv76AeuFYNYjYxRrqhlr3NKR:O1Q6eOyQ5UzXpmK8y1alr8R","tlshash":"2c53e88535d9b0ab42837878946f310bf1ab6d52681c8410db1dd4dabcb4e49e63ffe8","first_seen":"2025-08-04T01:39:06.738468Z","last_seen":"2026-07-03T22:44:54.827943Z","times_seen":185,"resource_available":true,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-03-18","alert":"Hunting_JS_WebAssembly","trigger":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/notification.mp3","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:07.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /notification.mp3 HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:08 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 10880\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\npriority: u=4,i=?0\r\netag: \"69b778d9-2a80\"\r\ncontent-range: bytes 0-10879/10880\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=updPNl2vwRAhD7LcgK0bUPgkVLpVHJ0baq04hIeq7JyTkm%2B88sb4z8wAFbMRm%2FwiONoJkrGFv7EzRQEYs3Oq83qJX8PxvtAx4R2Z2uQZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae1b48db5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10880,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo","md5":"eba09b6a457792c52fc610b5f9f974b3","sha1":"95e6e0f7648e28ea21bc434054ea59aba3a35aea","sha256":"86093551f5a7f68c7dcac947bd8dc54c6a79dd9a5d83f7e40116d640eb28c7d6","sha512":"9dfc5ff830c9ed75c9923528c31e1361fa36500d76a209cd475984e5585a644c8aff1600bf02a658ef363436a51988ff1e63aa7606e541dc4a7b3449c5be4852","ssdeep":"192:RuQQeX7rYX/WUUIk8DLh+2BHpZqlXCYP69tuORf6tVQRa/nwNQBv5JC:RRYeUUEDLk2VClyaV0aZ5g","tlshash":"37226b18af11056ef4866bf0b3939b8dc42d26c37a26d4cdd3a5d7e369430e2a7d500d","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-08-11T05:55:54.328987Z","times_seen":16895,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":427,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/3345.86ef7d5fa6d231350df9.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.750Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /3345.86ef7d5fa6d231350df9.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-b2e\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=geJsvSFRUnv9Rp%2FHi6QC92cpYfpHQ7IFEhByQ0qH8%2BVfSNiQDdTMcjNKYpiizGuWa%2FatVX4u8QkrXfnsrwRcUYZPeiq36nAGjEoaHtza\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae336d0a5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2862,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2808)","md5":"c82fcd023cc92eb737498eb0ac082493","sha1":"264ea08bcf0300c79cb19c7f1c3851fdc3ce052e","sha256":"f4abe2f20e52b200095fb0e37ea7ec1d1048c0c1e3ac70159d6c065e311434c6","sha512":"547f9ff30ac0411a095ef8141713e23e1a9ffd5f5382cacd9f58c2c10fb4af3c10ed899248d7dd3d5fb1fb568d39eb85f80efb2a2f095bbc920a77c5d05890f6","ssdeep":"","tlshash":"05510a482a73387a2c6747abf8573b120d6513b23819f49316199eef8a7724f4b03f49","first_seen":"2026-03-05T13:07:53.773162Z","last_seen":"2026-03-30T16:56:15.765166Z","times_seen":28,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/3345.86ef7d5fa6d231350df9.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /3345.86ef7d5fa6d231350df9.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-b2e\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yMeT%2FTgTlBcgmXQqFlz4nr6GoWh08V6jG0GKeDaz8Uws8qC20IATLDk8nXLpU7bUkRcY2QjEUbF5CtMiIRL4O5QbFbCp0oojZsBqvECJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae336d0b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2862,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2808)","md5":"c82fcd023cc92eb737498eb0ac082493","sha1":"264ea08bcf0300c79cb19c7f1c3851fdc3ce052e","sha256":"f4abe2f20e52b200095fb0e37ea7ec1d1048c0c1e3ac70159d6c065e311434c6","sha512":"547f9ff30ac0411a095ef8141713e23e1a9ffd5f5382cacd9f58c2c10fb4af3c10ed899248d7dd3d5fb1fb568d39eb85f80efb2a2f095bbc920a77c5d05890f6","ssdeep":"","tlshash":"05510a482a73387a2c6747abf8573b120d6513b23819f49316199eef8a7724f4b03f49","first_seen":"2026-03-05T13:07:53.773162Z","last_seen":"2026-03-30T16:56:15.765166Z","times_seen":28,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/6805.122c42ed2dab78b484d5.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:11.317Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /6805.122c42ed2dab78b484d5.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-1cb5\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JGL1juuKdABdk6XdMy%2F7Y8dX0TnmxoA1uZ1iO6JdhhiF79ZHyuwUHBu5QMzfxOaZ753uF0OhQUblNmS7VvFfyJMSN%2BjN9S8HTkWpzZSY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae30bc835ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7349,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (7295)","md5":"7656a1330550a33a5c92d5918440142c","sha1":"4ab41db32fc440c4efe16db8d3549349ccf4fe39","sha256":"ca77ff078741b78d604e9d5111397b96f0bf833c7463e590beb8457aed1d1601","sha512":"6e170851709145915734859060da4546a5af2610fb37c1941da1c7df24c5ea5ebe5e89c2ea9481f0ce439a2e7c02e9fd5a034bbd3562aeb45fcd86c00ea8aeb8","ssdeep":"96:SiW936N68UWhdT7ZqV9aZ+dQupaX976INDgr2Bst41opKWIMAbEzFWbCT960u7J+:SiMq8piPCvDYh6Ej7EYbCT4R9Xbuoq","tlshash":"05e1b4d63752593ee3969dcaad3e1043a0a1d92c39188164772a5ceb3d27dc1e0b2f53","first_seen":"2026-03-05T13:07:53.784783Z","last_seen":"2026-03-30T16:56:15.770545Z","times_seen":28,"resource_available":false,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/6805.122c42ed2dab78b484d5.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:11.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /6805.122c42ed2dab78b484d5.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-1cb5\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ENbmMUUIBDntfe6ZQOc%2BZcAKC7AOYyOIFkZJBnNz9lS20xNUMwWaOxgTsQwh8XmH%2FHXQWOYauq0hBSK7AdDk61epsYkN4naBLqy0ey3z\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae30bc865ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7349,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (7295)","md5":"7656a1330550a33a5c92d5918440142c","sha1":"4ab41db32fc440c4efe16db8d3549349ccf4fe39","sha256":"ca77ff078741b78d604e9d5111397b96f0bf833c7463e590beb8457aed1d1601","sha512":"6e170851709145915734859060da4546a5af2610fb37c1941da1c7df24c5ea5ebe5e89c2ea9481f0ce439a2e7c02e9fd5a034bbd3562aeb45fcd86c00ea8aeb8","ssdeep":"96:SiW936N68UWhdT7ZqV9aZ+dQupaX976INDgr2Bst41opKWIMAbEzFWbCT960u7J+:SiMq8piPCvDYh6Ej7EYbCT4R9Xbuoq","tlshash":"05e1b4d63752593ee3969dcaad3e1043a0a1d92c39188164772a5ceb3d27dc1e0b2f53","first_seen":"2026-03-05T13:07:53.784783Z","last_seen":"2026-03-30T16:56:15.770545Z","times_seen":28,"resource_available":false,"data":null}},"time_used":416,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":416,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/3345.86ef7d5fa6d231350df9.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.747Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /3345.86ef7d5fa6d231350df9.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d7-b2e\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XAQElW9TaHD2IST6AxHzo%2Bnhrud6QcIi0b69xagiguXL%2FZtpOB1wnmlkxq3aBwevpYRm9kADIfFkQdfpfcQ4r06WkDhTlZiOO0MFlGHM\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae336d085ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2862,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2808)","md5":"c82fcd023cc92eb737498eb0ac082493","sha1":"264ea08bcf0300c79cb19c7f1c3851fdc3ce052e","sha256":"f4abe2f20e52b200095fb0e37ea7ec1d1048c0c1e3ac70159d6c065e311434c6","sha512":"547f9ff30ac0411a095ef8141713e23e1a9ffd5f5382cacd9f58c2c10fb4af3c10ed899248d7dd3d5fb1fb568d39eb85f80efb2a2f095bbc920a77c5d05890f6","ssdeep":"","tlshash":"05510a482a73387a2c6747abf8573b120d6513b23819f49316199eef8a7724f4b03f49","first_seen":"2026-03-05T13:07:53.773162Z","last_seen":"2026-03-30T16:56:15.765166Z","times_seen":28,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.898Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /rlottie-wasm.b8cd14b929a7127811bd.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:12 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d9-10001\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L88UYKS53UrGnCclxJouX0K3Nk2A0O8kd9YHcU%2B2f%2FY1M3Ydi1BLnPMTrYf0rl6f7x5z6654aDgx8R8R%2FhR%2FJHOZCVvlATXklJlFcLsY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae345d365ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65537,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f9197a18681b7cc4f51b1911286902b0","sha1":"3f585990b02c98c9d787cb74c2a52fdf5d753b98","sha256":"bed5811a3341e35e206eaf3a0518c50edfe50ee9da37480286ac38ff29813c0d","sha512":"9679389c7ae84ee258a31c28e0da91ca3885c491f3e15e544d04c0bbb73c820e03ef8a834d96be0d29305534b18302f2b0110d9361e1d5f34a0fed38912550cd","ssdeep":"768:O6g4cP2yQ6eO0PDlgTdxHzvszXIn2B1ARnv76AeuFYNYjYxRrqhlr3NKR:O1Q6eOyQ5UzXpmK8y1alr8R","tlshash":"2c53e88535d9b0ab42837878946f310bf1ab6d52681c8410db1dd4dabcb4e49e63ffe8","first_seen":"2025-08-04T01:39:06.738468Z","last_seen":"2026-07-03T22:44:54.827943Z","times_seen":185,"resource_available":true,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":274,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-03-18","alert":"Hunting_JS_WebAssembly","trigger":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/6805.122c42ed2dab78b484d5.js","date":"2026-03-18T22:30:11.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /rlottie-wasm.b8cd14b929a7127811bd.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/6805.122c42ed2dab78b484d5.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:12 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\netag: W/\"69b778d9-10001\"\r\ncontent-encoding: gzip\r\nage: 0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fs3Y13BXe7Dbyr0jGEXanwetLQ8U5NIbVE9mTx6r2u4ejLyw1LUUQlUZbTj8UtMCGNRFm%2FJvUp%2B2PLBgdaXZreHkfSxvLj2qXIKDr8TP\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae345d385ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65537,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f9197a18681b7cc4f51b1911286902b0","sha1":"3f585990b02c98c9d787cb74c2a52fdf5d753b98","sha256":"bed5811a3341e35e206eaf3a0518c50edfe50ee9da37480286ac38ff29813c0d","sha512":"9679389c7ae84ee258a31c28e0da91ca3885c491f3e15e544d04c0bbb73c820e03ef8a834d96be0d29305534b18302f2b0110d9361e1d5f34a0fed38912550cd","ssdeep":"768:O6g4cP2yQ6eO0PDlgTdxHzvszXIn2B1ARnv76AeuFYNYjYxRrqhlr3NKR:O1Q6eOyQ5UzXpmK8y1alr8R","tlshash":"2c53e88535d9b0ab42837878946f310bf1ab6d52681c8410db1dd4dabcb4e49e63ffe8","first_seen":"2025-08-04T01:39:06.738468Z","last_seen":"2026-07-03T22:44:54.827943Z","times_seen":185,"resource_available":true,"data":null}},"time_used":272,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":271,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-03-18","alert":"Hunting_JS_WebAssembly","trigger":"atb-online.org/rlottie-wasm.b8cd14b929a7127811bd.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-18T22:30:05.978Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 18 Mar 2026 22:30:06 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 16 Mar 2026 11:44:21 GMT\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qtcR5Oz70W8qSvfi9mUOiZboSoGApOCTgx7rzAGTtUfhK3b0yTy3aPMOMY0wWqZvuGMFVspyRe2m7NWO0Qg9WcP0Wgiv4oKLAoirAF86\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9de7ae0fd90c0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4445,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (2828)","md5":"4d8eea332baec3bdc187d4b35fe4e93b","sha1":"a251dc672feccacea56683a1ca57f2593c55274c","sha256":"827a0b191137264274f779fe09957eb96041fa730e2d76036454052b514226a3","sha512":"4db57f9b159d7e2a6cc5d68f8da6908fb5a2f21ee7917f72b859e4913a58155f1196515681cf4557b1125a25010bc51101dca51572c19102faf12ad372a02db7","ssdeep":"48:0i9c5Qv0td+rGW3pgs3ZFljFzLD5HyiBmzce5HxhnSn2BBc+tu/iSV+QcBLQsa1/:HELUG+msenSOc+U1Ma13poB00JFySPCN","tlshash":"8e9180931b14c84d23218636daf7f088c225c40ed9a9ac80f59552da4ef5fe8d573ba8","first_seen":"2026-03-18T22:30:31.655758Z","last_seen":"2026-03-18T22:30:31.655758Z","times_seen":1,"resource_available":false,"data":null}},"time_used":602,"timings":{"blocked":86,"dns":63,"connect":1,"send":0,"wait":424,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/redirect.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:06.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /redirect.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:07 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0qQxS40RoUI%2BpLR6dLRXwY2oBknh1YMbRBB%2B%2B%2FWiWPHc2MstMddeRsUYz5iE8UEvcO%2BvF85TUQ%2FIQJKg8ivqSxBgqnvqqGVxCIjenHsh\"}]}\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\npriority: u=2,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"69b778d9-145\"\r\ncf-ray: 9de7ae13df1f5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":325,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"17773b57b87a678c98e26a7cac72df6c","sha1":"7422857aa75ee81cabcec2eed6c4a6168f363ee1","sha256":"375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f","sha512":"28d9e1c2af08154e653e2291db46f4110edbf9f5591192f8d695c8852f9c3c755d69dfb5a032a45f51e0a3fc9417f16c20d0772b1225ca9b85e5531e12fa8bfc","ssdeep":"","tlshash":"e8e07dda0279030417e013f36d82b4709137c2fb604c5d028d984321a1b9b4f5b7b84f","first_seen":"2023-07-27T09:32:34Z","last_seen":"2026-08-11T05:55:54.245741Z","times_seen":11540,"resource_available":true,"data":null}},"time_used":442,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":442,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/main.591b17ddb6e56c8911a0.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:06.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /main.591b17ddb6e56c8911a0.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:07 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\netag: W/\"69b778d9-83cca\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=huVeP7nl0hyFXiCRieJB6USwKtsmrSpGO9cSM1%2B2DJCxXHJUtxzNiTHdalcyEBq%2BWtfXLzExJk47TP4I4WuDDBqwMlVtUuZZ5FDzF%2B5b\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae13df205ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":539850,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65488), with no line terminators","md5":"c1517c9cee9a7840af585c3070ad456f","sha1":"8675892bab5b837b118939944363022690d87128","sha256":"1ea654a57b597476f5c2d6fb795f6d283635f8740cd4eb9b22377bf92d9d4841","sha512":"8b19bce10e3e9349f39f87fe67a076fa513fb02cb6a70f7ae872698fd5fcbe540f47ceb14d6182ddf3321d5559e6061946645829a784855d33523f677ab4f643","ssdeep":"12288:rgSn5dYhZDItfCg4rKLqbLnaLIqQi66KZM6KdW/QuQjv49Hk+EZm94ekHQVIi15s:/nP2ZEfTJ/Ll","tlshash":"e8b43cd571d674ea63e309e6a4ab0098b7395944380dc4a0f16dfce93d364aaa373f4c","first_seen":"2026-03-05T13:07:53.781931Z","last_seen":"2026-03-30T16:56:15.76718Z","times_seen":28,"resource_available":true,"data":null}},"time_used":974,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":586,"receive":388,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/main.5d38a7064fd76f8d01a0.css","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:06.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /main.5d38a7064fd76f8d01a0.css HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:07 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 16 Mar 2026 03:28:25 GMT\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\netag: W/\"69b778d9-1f631\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cL33tc9Likm7gSYwTYj%2FiGulqamNnhZRLWiKCCDC7FYYAEC938QdygefAmYqaGvft8o1j7bfygIQgfQMC6TUpM0E6DoZsU97jiVm6M0y\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae13df1e5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":128561,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (12358)","md5":"fe9f02da9c09971f8109d2dd88ffe3e3","sha1":"c38eb5448b1950f11a8fa8eef46b5a7535660864","sha256":"c877cb3630292d19fadee72bdd612f21aec3bbd3d79d823e4362ecee714a8a03","sha512":"c00bc8769fb1ae7da8f08f1f4d55fc0a425d15efc1717361caa293e006b5ee13a9bf891c908dffa46257bf84c9c2c198a1710ab9dcd735af7230dcd1139e8b1a","ssdeep":"1536:wBizdRzJrsPQqsMkhQpRvIU8W+HYOpem5fXwIH:LdlJrsPQ4EQWBd","tlshash":"7cc3e798e94411f9a723c63e97c4e76c8938e481de610faff247615c07cb7ea12d2b58","first_seen":"2026-03-05T13:07:53.794759Z","last_seen":"2026-03-30T16:56:15.767779Z","times_seen":28,"resource_available":false,"data":null}},"time_used":586,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":563,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/compatTests.js","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:06.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /compatTests.js HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:07 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dca8Elio0ZUC%2F0mfws2JIEjDtfJTY8VjE3uqmYjew2toQWhEMTZ3yjquPVp0feFqrUcopNd4NySW%2FxKNAKSqYJ0lhKFPEhxvVFk7R6vy\"}]}\r\nlast-modified: Mon, 16 Mar 2026 11:45:41 GMT\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"69b7ed65-a4\"\r\ncf-ray: 9de7ae13df215ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":164,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"b1137a70e5094e046802b348818587a6","sha1":"0c1f0f10cb8da14c78ee02a5854f69db53975b11","sha256":"8d0da8170edc28b34c30ef67197035487deefc00600f9762bcaa886ff652f488","sha512":"5e99951d68ec5f1ac8a8ce7950dce81346943f673b4732e66a2a1ea8ec4c704128cfa1ba082ed375b8a669d26d028cddaa3b370b7426af70e0cd64ccfd7e9c86","ssdeep":"","tlshash":"59c08c45d4e007b8a2b100af53473a64a3b20305400ba610e04c0b4c3d74e0f4950ebf","first_seen":"2026-03-18T22:30:31.658172Z","last_seen":"2026-03-18T22:30:31.658172Z","times_seen":1,"resource_available":true,"data":null}},"time_used":434,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":433,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:07.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/main.5d38a7064fd76f8d01a0.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:08 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11016\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\npriority: u=4,i=?0\r\netag: \"69b778d7-2b08\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2dHNEiILlA2jX0wFcTu07k6qy%2FOuTwn%2BJY%2F0NAxB0c6UD1QqiFBtMjjWmcgzW4%2BQItRZPeN2LBufZHAOYG7OzJa9POI7dBdK7PzbekyY\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae1b28d95ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11016,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11016, version 1.0","md5":"15fa3062f8929bd3b05fdca5259db412","sha1":"6ff06a34f68ad0324ddec1bbe4d453c959178b36","sha256":"5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479","sha512":"07e96d7520b4ede158e77bef10a01a33cd8be7d263fe6900f89c023e65e4a63570e8a442dec2e96030fb563b25610005a748d48f9330fd31eb91b37d1003d376","ssdeep":"192:Tysuo7z1NVoTUYAKVOO7YVxRwHQUXFI5xoBwH9f4d9QFmOfiS:TvdvVoTSjOYR4QUVIgBwpFLaS","tlshash":"6e32af8071ff1c50ff85c2f69be68efa2c2b1895c619016f5240b476397525e9c294bb","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-08-11T13:10:20.788589Z","times_seen":34538,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":416,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atb-online.org/icon-192x192.png","fqdn":"atb-online.org","domain":"atb-online.org","tld":"org"},"ip":{"addr":"104.21.42.127","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://atb-online.org/","date":"2026-03-18T22:30:08.093Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atb-online.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 08 Feb 2026 15:40:12 GMT","end":"Sat, 09 May 2026 16:28:28 GMT"},"fingerprint":{"sha1":"72:56:73:59:4B:2D:1A:4A:13:2E:6D:FE:77:13:26:A0:D9:37:02:8C","sha256":"4A:01:A4:0B:74:C1:43:D2:41:CC:4E:D4:94:CE:FA:12:E2:BA:51:D4:2A:3A:0C:F3:08:02:CB:C5:19:9D:E9:D0"}}},"request":{"raw":"GET /icon-192x192.png HTTP/1.1\r\nHost: atb-online.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atb-online.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 18 Mar 2026 22:30:08 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 16 Mar 2026 03:28:23 GMT\r\nvary: accept-encoding\r\npriority: u=6,i=?0\r\netag: W/\"69b778d7-bf3\"\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CynROr9QFK9uWVWBPmvTcGWs3vj%2F5sYMtfP2yFmyyCR8qNDuQqxo5jp%2B%2FmaT5rJjb8QAWxm7iZvoXj%2F20H03YdWlbzWJSwQvH6qjA2TH\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9de7ae1c891b5ebd-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3059,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"1a1650d2c76bfc1ac484646c19e495b9","sha1":"fe58d66042ce9241226f5da9370230285ff604fc","sha256":"6e587a62c9d7a97f25265ab5eb29d101ad2e36810042a4116d2dd29da96b0bf8","sha512":"79c5c9278959bc94f66434779bebc1b46c055655f0bc58aa375f179c227e7ac0e52dea196764719d42aadcf98e4fd3b5a4488f2db977edde430aa3df733c03bc","ssdeep":"","tlshash":"bd514cd3253318e8e2dbfd7ace62041f656691ce5638ec120568de720c8985dc070caa","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-08-11T05:55:54.190987Z","times_seen":16536,"resource_available":false,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-18","alert":"Phishing Block","trigger":"atb-online.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}