{"report_id":"44342814-7738-4900-8208-f9a71c17503e","version":0,"status":"done","tags":[],"date":"2026-07-15T11:37:07Z","url":{"schema":"http","addr":"xoomaide-transactions.help","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"xoomaide-transactions.help/404","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"title":"xoomaide-transactions.help/","dom":{"size":1154,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (413)","md5":"330dfa5dd3ffd664e298288ea3c46f36","sha1":"851e7b62cb52cc26a2c8280d7800a0de61b80e65","sha256":"98814a3d284d8951474b83dad84af22e310664513fed9be2d4019ae202625be5","sha512":"793dc46d77355f710cc6c0858689ae200cbdc2fdce4ea9d7afaf95de7f66a6b122731018542257588827c1bd34b9d3b1b2b1e449d79ea148b24fc0000461c6f9","ssdeep":"","tlshash":"1021336700a0043b231302a27c91fb25bc8aa30fd556e551f5f641e91be4dc2c8d747c","dom_hash":"domhashf3c397dd7d190604cd2d680019a5670e","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"xoomaide-transactions.help","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":0,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-19T11:37:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"xoomaide-transactions.help","ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-07-13","domain_rank":0,"first_seen":"2026-07-15T11:37:09.216272Z","last_seen":"2026-07-15T11:37:09.216272Z","alert_count":9,"request_count":9,"received_data":1335823,"sent_data":4601,"comment":"","tags":null,"fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}]},{"fqdn":"httpbin.org","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2011-06-12","domain_rank":6779,"first_seen":"2013-07-23T00:01:27Z","last_seen":"2026-07-12T17:20:30.157475Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":480,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-12T22:22:25.184057Z","alert_count":0,"request_count":1,"received_data":12821,"sent_data":557,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"xoomaide-transactions.help/assets/index-BCVyfh-C.js","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"8d1cb9a3744df67407851a34c7ff10cd","sha1":"51182b49cd9c034fd373f5243ff2f5fb8c417dad","sha256":"285034c03a1bb1bc0ba5bae49774c62db301b91931bba1c999056505d327f12b","sha512":"e72ff066b8346bd353968b3454ebca6d7b715dcabc8c606a01da84f0a8365c7dd1162ac6ee899d8449c0b696b04937b8609a3a09c6b1ef1649c3b1403c15b540","ssdeep":"24576:/QU+EmzfPHWVjftG2J7gY4sff9ILMV2HhhFAFXhjqOrkigzWe:/QAmzfPHWVjFG2J7gY4sff9ILMV2HhhT","tlshash":"42557cd87281b432d7a785e590bf000ab33a2924780dc894f17cddde29a5549e27bfbd","size":1315474,"data":"","first_seen":"2026-07-06T17:09:27.16254Z","last_seen":"2026-07-15T11:41:09.791887Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"Error:map[actor:server1.conn0.watcher16.process8//obj21 class:Object extensible:true frozen:false isError:false ownPropertyLength:7 preview:map[kind:Object ownProperties:map[code:map[configurable:true enumerable:true value:ERR_BAD_REQUEST writable:true] config:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher16.process8//obj22 class:Object extensible:true frozen:false isError:false ownPropertyLength:16 sealed:false type:object] writable:true] message:map[configurable:true enumerable:true value:Request failed with status code 403 writable:true] name:map[configurable:true enumerable:true value:AxiosError writable:true] request:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher16.process8//obj23 class:XMLHttpRequest extensible:true frozen:false isError:false ownPropertyLength:0 sealed:false type:object] writable:true] response:map[configurable:true enumerable:true value:map[actor:server1.conn0.watcher16.process8//obj24 class:Object extensible:true frozen:false isError:false ownPropertyLength:6 sealed:false type:object] writable:true]] ownPropertiesLength:7 safeGetterValues:map[stack:map[enumerable:false getterPrototypeLevel:2 getterValue: writable:true]]] sealed:false type:object]","filename":"https://xoomaide-transactions.help/assets/index-BCVyfh-C.js","line_number":355,"column_number":6135}]},"http":[{"url":{"schema":"https","addr":"xoomaide-transactions.help/api/check","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:33.596Z","timestamp":1784115393596,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"GET /api/check HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:33 GMT\r\ncontent-type: application/json\r\nx-powered-by: PHP/8.4.23\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50,"size_decoded":215,"mime_type":"application/json","magic":"JSON text data","md5":"eeba55746c1ac85b715b1f5a6d761de9","sha1":"a8b9659c3f72062732078ddddafcacfaa2bab627","sha256":"90202b1d54ecf91fd1df30cd53bedc9e1f30cf7a889b0c15d444d297e6b2f310","sha512":"1bdb318529d8c652d1abc52e1969f16907832b8bb06e70b34a410653ca940627470df8ccdfe9cb2da76fa5781f5f9c21131533e9d4b5a6a1d995f0f073d3c550","ssdeep":"","tlshash":"cb90020c13840009036b07010f93055810501270e9102b016ef4106804024464423051","first_seen":"2025-01-04T14:09:57.907294Z","last_seen":"2026-07-15T13:11:58.454604Z","times_seen":157,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/api/user/status","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:35.630Z","timestamp":1784115395630,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"POST /api/user/status HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 32\r\nOrigin: https://xoomaide-transactions.help\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/404\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":32,"data":"{\"status\":\"offline\",\"userid\":\"\"}"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:35 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: https://xoomaide-transactions.help\r\naccess-control-allow-credentials: true\r\nvary: Origin\r\naccess-control-expose-headers: Authorization\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PHP/8.4.23, PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44,"size_decoded":418,"mime_type":"application/json","magic":"JSON text data","md5":"4d1227aeb7552967801938726a234ad6","sha1":"049e5a5b647cdcae2c3ee175af4c8b89e24eb348","sha256":"221445274fc2ac44ead41b041e0a78b020c1f9cd0d49ff2c29d29fcd182e6137","sha512":"c2c3747f1d2d17f1c91186c3bb8e18ef754fae8610abf2475f6e9220f5c6ae4740c6f89e37c43dc12e33588622d15b07c6c2a17f7d35d0012608f18ad64958de","ssdeep":"","tlshash":"7d90020c0143292a630352223655762045d9019144619a15144a480801144425c0254b","first_seen":"2025-04-10T19:42:39.237509Z","last_seen":"2026-07-15T11:41:09.776706Z","times_seen":85,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/assets/index-COPvltms.css","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:32.195Z","timestamp":1784115392195,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"GET /assets/index-COPvltms.css HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 08 Jun 2025 13:29:50 GMT\r\netag: W/\"6845904e-3b3b\"\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":15163,"size_decoded":3853,"mime_type":"text/css","magic":"assembler source, ASCII text, with very long lines (15162)","md5":"b4de12f83a646125be3860840c5c20b4","sha1":"aace8c8a6c84b298afc3904036f7e0fbc53df45f","sha256":"a141577e61a5318b2041bf36142e7e20b304c7d3d54b6f36364933849752918e","sha512":"36ae14dba367f1cf89b06ba34d70edc46ad63843850689ed34f2cb8b8040169c66be690c0b918f80d6faab34c317274d76eec506c9816b76844e11f86f591d68","ssdeep":"192:hyxwOW9JyW9Jy9uDMw6Up2NyNK1eZNjr+Hy87:hUwV49heZNjr+HR","tlshash":"0c62755d6b0414367c5780f7e5e4ee89b227a4c1df2be6fab8875110ebc23e21993718","first_seen":"2026-07-06T17:09:27.159919Z","last_seen":"2026-07-15T11:41:09.781052Z","times_seen":3,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/api/user/status","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:33.189Z","timestamp":1784115393189,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"POST /api/user/status HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 31\r\nOrigin: https://xoomaide-transactions.help\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":31,"data":"{\"status\":\"online\",\"userid\":\"\"}"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:33 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: https://xoomaide-transactions.help\r\naccess-control-allow-credentials: true\r\nvary: Origin\r\naccess-control-expose-headers: Authorization\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PHP/8.4.23, PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":44,"size_decoded":418,"mime_type":"application/json","magic":"JSON text data","md5":"4d1227aeb7552967801938726a234ad6","sha1":"049e5a5b647cdcae2c3ee175af4c8b89e24eb348","sha256":"221445274fc2ac44ead41b041e0a78b020c1f9cd0d49ff2c29d29fcd182e6137","sha512":"c2c3747f1d2d17f1c91186c3bb8e18ef754fae8610abf2475f6e9220f5c6ae4740c6f89e37c43dc12e33588622d15b07c6c2a17f7d35d0012608f18ad64958de","ssdeep":"","tlshash":"7d90020c0143292a630352223655762045d9019144619a15144a480801144425c0254b","first_seen":"2025-04-10T19:42:39.237509Z","last_seen":"2026-07-15T11:41:09.776706Z","times_seen":85,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/api/config","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:33.192Z","timestamp":1784115393192,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"GET /api/config HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:33 GMT\r\ncontent-type: application/json\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PHP/8.4.23, PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98,"size_decoded":274,"mime_type":"application/json","magic":"JSON text data","md5":"1c57f12e90660f9bc612b7860e5c9040","sha1":"fd29433cc86cc3d046f365fc64fef07742072a7d","sha256":"e68b369ba24b78dde63c5a2d3f267843797c7aa42e43c7c8025e1079d0873d3b","sha512":"e05032e4d5e09ecd66dc7ce27dc0d9806a01cdfaa445b6a916d72f66785bed00c25277aa37ced93db76602827e5adf613246d601b9159db9c86a24f67e6c8f55","ssdeep":"","tlshash":"d9b0021b49110771c54554449217ff524d7f117770165019b56d72d16174e47156482f","first_seen":"2025-10-17T13:45:55.494894Z","last_seen":"2026-07-15T11:41:09.788521Z","times_seen":16,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/vite.svg","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:33.194Z","timestamp":1784115393194,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"GET /vite.svg HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:33 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1497\r\nlast-modified: Thu, 22 Aug 2024 19:05:58 GMT\r\netag: \"66c78c16-5d9\"\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1497,"size_decoded":1779,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8e3a10e157f75ada21ab742c022d5430","sha1":"f7f39d7237b791a945d52a5cd7a8fb365f313366","sha256":"4a748afd443918bb16591c834c401dae33e87861ab5dbad0811c3a3b4a9214fb","sha512":"fbf065e26d907454cb432a17d831f448e1c3df0f33cd681ccc52b63e5bc26bc9e4de08591a2de579e5b05219fcffd3b4d4261ada6fa55299e731343df860488d","ssdeep":"","tlshash":"2031451fda7fd4fec0a6cb48e612b047962c30d95e41c5b4d9845f0e64a19f17c0aa64","first_seen":"2023-05-18T16:20:30Z","last_seen":"2026-07-15T15:09:13.665801Z","times_seen":6016,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"httpbin.org/get","fqdn":"httpbin.org","domain":"httpbin.org","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:33.606Z","timestamp":1784115393606,"http_version":"","security_state":"","security_info":null,"request":{"raw":"HEAD /get HTTP/1.1\r\nHost: httpbin.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://xoomaide-transactions.help/\r\nOrigin: https://xoomaide-transactions.help\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"HEAD"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-15T15:18:35.325723Z","times_seen":17267238,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/api/bot","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:34.110Z","timestamp":1784115394110,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"POST /api/bot HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://xoomaide-transactions.help\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/404\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:34 GMT\r\ncontent-type: application/json\r\naccess-control-allow-origin: https://xoomaide-transactions.help\r\naccess-control-allow-credentials: true\r\nvary: Origin\r\naccess-control-expose-headers: Authorization\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PHP/8.4.23, PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP:8.4.23","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24,"size_decoded":400,"mime_type":"application/json","magic":"JSON text data","md5":"936879557ac2f2020b31ec4ac574180b","sha1":"cc21a239a20f61c5dca6d84b4ee5734369a0e9a9","sha256":"2a4b7ac210a142c078d9a49b11222d95f6e092b0e544a7bb70b3096934a55dea","sha512":"cc051d9bd73e5d954220dde3d6cea9564c877dece197eba019746956ff4d991dcc647be2b9cb08093eaceec30eaeb6916cd16a0411a3cdaa94e778afdf561567","ssdeep":"","tlshash":"49700022220a8ece2000228280280c0020e800b080008808c03c00088e000a030a2008","first_seen":"2025-04-08T11:37:44.740552Z","last_seen":"2026-07-15T13:11:58.46481Z","times_seen":180,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-15T11:36:31.355Z","timestamp":1784115391355,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:31 GMT\r\ncontent-type: text/html\r\ncontent-length: 406\r\nx-accel-version: 0.01\r\nlast-modified: Sun, 08 Jun 2025 13:29:50 GMT\r\netag: \"300-6370f752a2f80-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":768,"size_decoded":763,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"da4562b14af586de3a69a1c42ee2942b","sha1":"53edd3ea00908e4511cae7ff67a67be092504ba0","sha256":"89c3b07cb7e4d8c535c3ba08158ff784d1e42c053eadeda939decc8bce0c0a25","sha512":"eedd329408ad465ac82e88689db681e635e7b42833648c47c050bdc23de46d45db0e72befd1abca649b9adbc6aa4b4b73130ca4b17fb44b0e6a29f5f066c9768","ssdeep":"","tlshash":"400165a340e0892a232003a16dc1f9298d4bc60b438c9a4471b750fe8fc47c1cddf96c","first_seen":"2026-07-06T17:09:27.156518Z","last_seen":"2026-07-15T11:41:09.784987Z","times_seen":3,"resource_available":true,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":287,"connect":59,"send":0,"wait":67,"receive":0,"ssl":124},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:32.191Z","timestamp":1784115392191,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=Open+Sans:ital,wght@0,300..800;1,300..800\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 15 Jul 2026 11:36:32 GMT\r\ndate: Wed, 15 Jul 2026 11:36:32 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12137,"size_decoded":2425,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"7fbc57b14bea8d6561fdb50fc9c3008c","sha1":"9c9ed86aaf4ca655f083c9c80db324d053d3dd11","sha256":"d90d7d2947e295cba230edef392df55e276c2f3c87e04908d093aeb005da805a","sha512":"d70400de88d9d540ba4e871b2c2c4b997f81bdf1765150d65c2ab18a959c9efa4f910735b3873d43e1eabc646c078533972106c111a4838357f866b44cf57c40","ssdeep":"192:+foOfcfLf9L5fMfgqvfZbqGIwV49fOnf+ofjCXXS2asrqAnbqGIwV4uxzBY:+QOkTltULv1qY49GnDu6SqY47","tlshash":"9f420c910417144096835dd233de7e34ee0fa6616044c0baabfd9bdbeecad69a3b435c","first_seen":"2025-09-17T08:42:41.023406Z","last_seen":"2026-07-15T14:42:33.323478Z","times_seen":6986,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":33,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xoomaide-transactions.help/assets/index-BCVyfh-C.js","fqdn":"xoomaide-transactions.help","domain":"xoomaide-transactions.help","tld":"help"},"ip":{"addr":"158.94.208.174","port":443,"asn":786,"as":"Jisc Services Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xoomaide-transactions.help/","date":"2026-07-15T11:36:32.193Z","timestamp":1784115392193,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xoomaide-transactions.help","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 13 Jul 2026 23:10:12 GMT","end":"Sun, 11 Oct 2026 23:10:11 GMT"},"fingerprint":{"sha1":"FC:65:E2:D6:6F:23:EF:E3:F5:E2:A9:61:50:7A:36:FC:FF:CD:4B:47","sha256":"F8:1A:DE:E8:4B:9C:04:3C:02:9A:3A:DF:F9:6E:E6:BD:8D:01:59:A8:6D:98:9D:0F:CD:07:4B:03:DC:D4:88:2F"}}},"request":{"raw":"GET /assets/index-BCVyfh-C.js HTTP/1.1\r\nHost: xoomaide-transactions.help\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://xoomaide-transactions.help/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 15 Jul 2026 11:36:32 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 08 Jun 2025 13:29:50 GMT\r\netag: W/\"6845904e-141292\"\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1315474,"size_decoded":388321,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (37550)","md5":"a5b137d0a4d6b297158300ae0b5bceef","sha1":"fcc74b6f554708c5d1428b31c833e31c4a537eed","sha256":"d65181bd74296014037250514d43b81187caad4169f599ea8a7bf5cba0626623","sha512":"7904451217916ec41f7bca4a0d2538d25802c211377c804ba20d13a968740a0f7be68ad019aa95c6860d9ded02ec8166a8fffd03d13f2ff9699fee706e6d8324","ssdeep":"24576:/QU+EmzfPHWVjftG2J7gY4sff9ILMV2HhhFAFXhjqOJ:/QAmzfPHWVjFG2J7gY4sff9ILMV2Hhh4","tlshash":"2a257dd87280b03197e786e590bf040ab33a2915780d84a4f17dddde3a79549a27bfbc","first_seen":"2026-07-06T17:09:27.158581Z","last_seen":"2026-07-15T11:41:09.787467Z","times_seen":3,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-15","alert":"Phishing Block","trigger":"xoomaide-transactions.help","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}