{"report_id":"492200b5-d31f-4bde-9f6f-68831a0e0e4f","version":0,"status":"done","tags":[],"date":"2026-07-01T04:39:03Z","url":{"schema":"https","addr":"evil-corp.app/","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"evil-corp.app/login","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"title":"EvilCorp","dom":{"size":16537,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9388)","md5":"c27cf1880a9d8068cbd23e9b179f9bad","sha1":"103be1077efc037d517a59648c08ed5ea1450697","sha256":"f7034972472d17c3a297d19fbd4e1573ff2d85617481733ecad0494c6d68d652","sha512":"d5f5ecf162c14f7f817b692088d0d7e3be5ebd8cc301054478e4dc33b4b5c0338aa8dddd09dbd3e69fe90a4a074091b71358fa72d116d1251f0c154b7c06f9af","ssdeep":"384:2r2J3Fh5unveEqB1Qh1pbr8rrrrrkx8D6fRB:2r2J3Fh5unWEqcdb3x1RB","tlshash":"e072a534b806cd165877996472b66f3ca0deb32ed9124ca8f3dd82035bd6df11786e81","dom_hash":"domhasha6279d52d9e26ab8d2413f01efc4a5b3","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"evil-corp.app/","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-05T04:39:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"evil-corp.app","ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-07-01T04:26:58.305514Z","last_seen":"2026-07-01T04:26:58.305514Z","alert_count":0,"request_count":82,"received_data":4812464,"sent_data":42403,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"evil-corp.app/login","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b40cdc025a72d0b516bd11d9ef0a1776","sha1":"9cd34b30af473b8071638d82dcacef0373194aaf","sha256":"43ef2d3ec8d5b620ec8c5fc2bfc14c3a9836620f75a0a14a0c025ab753cf6f68","sha512":"ffad498a0fda3194476aee567df0b821e3c4886662a0dc72a53e8289c98fc3187b991df3da95f0bc2fe1b238d3478ccfac9d39a23fa2e7928ff3be8461110af9","ssdeep":"","tlshash":"3aa001f190d29c69e43741ab687511161bac490d0109014123a198e91162a098f48e8e","size":72,"data":"","first_seen":"2023-10-09T10:35:22Z","last_seen":"2026-07-03T19:56:11.79137Z","times_seen":96579,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/login","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"954f105b7041dceea096e6b461444403","sha1":"883452ccedf6ce0a32d6fd4b91368267531646d8","sha256":"145c0438ff8267184bab607b443591a738ead567887ac3a50d21de4b50db69c0","sha512":"cb72d6a3ca5476f61e261d8777590e580ef2bb5c0e6d7f57f5def4ae22b5e5bfac4a9889f50accaa3b00fabb32f86971b9a17cb9274d188f906945118aa21c1a","ssdeep":"","tlshash":"55012844f447ece5ac72ed0d31394e3580c4afbc91e658c493cec6c244a19b8574ab8f","size":712,"data":"","first_seen":"2026-07-01T04:27:05.882252Z","last_seen":"2026-07-01T04:39:09.95314Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/login","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c07cf2494604702d184e44868ee8228e","sha1":"009a4d36b4ae9526b55a9d6db1c07bbb8e9a02bc","sha256":"0eccda84c997f2da48630213e3a30c7d8f1a5ac1a6e2dfb11c0204e5d479acff","sha512":"e431b443c4726f5f8e5d198b423c8f73d88aa43c3a3bf60451b506183ca9b2dad313fb7f5fb3f1fb6d25bc6ac240e01f70fefc5995361f3d036f661e6758355f","ssdeep":"","tlshash":"8dd0a7f5f294dac68d319b01f7d30c1018eddc2d4450de0c1198951c262aeb5d5c4a55","size":230,"data":"","first_seen":"2026-07-01T04:27:05.883119Z","last_seen":"2026-07-01T04:39:09.953727Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/login","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0390f6c641e1ea137872c0e31c239ef3","sha1":"49b7a2e8c6da511566269202cc0065759ea264fa","sha256":"eee37d8ca432f629969e5428c12c9ebda3ace9c8d36fb4a1e0d14787c85df903","sha512":"962a60a7b5e5ee1fbcbb23dcb3a17ef8bfb23433057cc22c6c1ccfacf90fd3e802365aecda76d092e16eea0659e2481fd6ea1cdd52001adb7198e413e4104649","ssdeep":"","tlshash":"f251cd3e6409dd8becad7c19027e9c3664cd497b07a5dabc86ddcf050a0247a27dadc0","size":3019,"data":"","first_seen":"2026-07-01T04:27:05.883949Z","last_seen":"2026-07-01T04:39:09.954301Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/login","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"c557970c8673d951a5c49db233c4d2e8","sha1":"846429f43a01f5599878e4364fe8ad65717708a3","sha256":"a428086e3c3439f1ad445aca8cb41baf2e5d9588517b1e79b39962aa0d201573","sha512":"388efc6f72a5a3b137e5053aaf111d43f346ce0cbf99d30d8b79bd3b4685a96812a36a20a211252922ce479b4f5424c4e06e1346a8ebc68014993fc261d06ec9","ssdeep":"","tlshash":"14e026d1ac02cc1edb279f66087e0c3920ccc7a447c6a9439589ce141e53d311de1dc5","size":360,"data":"","first_seen":"2026-07-01T04:27:05.884787Z","last_seen":"2026-07-01T04:39:09.954842Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/117-5fd6584fc4366ff5.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d13e87eb771cb1dc6c862544c92dd720","sha1":"846bf0013f880dd962a499008ad7b3c7fba8937f","sha256":"7bd6f41cfe0ce8b68c0fcfc0c580bf3f21c9d7b49f22665e6b21bb5ef49b476a","sha512":"1ba96f22742f8333dbe47235b5a037bb8c4764d0554ab1d6d1edad2fc722d6dbbdef50f5c89cb5daa9f8f6e684bcf53db54a3a7e237b1ed218b832bb75d809a7","ssdeep":"768:fO9P55e7wbSlPftVDK//d9icrEAKH1ag8xxqKjj3fOpDKdlr/NaO8Qr93UsGoROz:Ugw2l+Wc3mY5jFdl/iPsibn2kJ51oCv7","tlshash":"bcc3d8ba71d0f8e2079744e5843b400af3791c3b146f70a0a7a5cdd9b5a44eea1a3f5e","size":124364,"data":"","first_seen":"2025-12-16T15:37:48.63769Z","last_seen":"2026-07-03T14:21:30.949943Z","times_seen":1919,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/528.73ed2743b29a9385.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"229fb8280aa5f6850c3d93ffe8a42a81","sha1":"59c3ab378d6d0f0fcf0e3936da99681bd0c78261","sha256":"c19dcdb20c3e3b64f79f9d86318440f4983f2d1f2afa67958cec910a5c42a5d6","sha512":"8293370d951c6e03828e6d3e4561db39edf4e331cc303b22ab42ea39bd594f906948a72e10f34824379a2d137689ef87a05047a15d844e82b2341ec39fbb7e06","ssdeep":"96:edLqKx2KhmbTTcojTUZfg//qNgMgShrZH9JNPgB+BxIJvuKW9p93:AqKtmLcoDLU/zPgnJ/q","tlshash":"a2c1e8a932ca7878bf93bb144abf0109623a32b01508c0743a2fdd965b5596dd371adf","size":6077,"data":"","first_seen":"2026-07-01T04:27:05.834601Z","last_seen":"2026-07-01T04:39:09.943172Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/webpack-448b85f7147e06be.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"02e1104110c8927ddc798e6a0b037951","sha1":"db429d7e5d5a580741611652689d3adabaf35620","sha256":"1ca7bc35f9a4643e78e8b8d6351e0250bd0188deea947121f7cf62c3955e74c9","sha512":"4ababfb1a58cd53fa294e733c6b0e1902267aa11162b086075a5895d8026853f2489274030853ae1031e973ffadf90cf627679f8521b7fb7846de42a3456aa27","ssdeep":"","tlshash":"248175de32a4f979179398a1043fa557f23e14b2282ed0a0db19d8f5bc745498523fe8","size":4018,"data":"","first_seen":"2026-07-01T04:27:05.860708Z","last_seen":"2026-07-01T04:39:09.915226Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/app/login/page-2721a7bb6040fd8d.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"624bd3524b551332c88c110c8e30644d","sha1":"8fc3206a76b6d90231b0763d8783ce23bff8af04","sha256":"ec54750a5f9c9e103d657df155bdc86b5435682278c9462caa7076cce914d8b6","sha512":"6004b2915ea76075cc4669a48c822f2cbadb0daef6c754c5df42466e2d263278b4b21efc02e1e376127cff2d280b5e8f7b127cff21ec9b3f4606cec666a61d1e","ssdeep":"192:JlXsZTdU0oMtfewCfXYhDJzy4geLngAFb3d9Im0q8e81vRE6bbqDDv6:J4pU0o6wfXY64d9Im0q8e87EuWDW","tlshash":"8662f9613653befcf67a046850bf800c716f7f68980b4814f3b86c122a564d5f6e6fa8","size":15957,"data":"","first_seen":"2026-07-01T04:27:05.85593Z","last_seen":"2026-07-01T04:39:09.921438Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/fd9d1056-6e8b9da6262156de.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d70ea42503ecdf865cc5b50951e7a260","sha1":"d6024cc44a508c5e42bccc99aa6939490273b3a3","sha256":"b8bddf9481d859d648e1e050f8322eb3defe3dd3f9bd13f4c44dd6f2ecf5ab80","sha512":"c38885a712287d6c88b14f3a78df8b03c671a1e8fe71ec680edad591b056eabd5cc510e7cf2b565d94779bbb258ca49068d31adb94d343d59c653c57e77035ee","ssdeep":"1536:PVjExazug79h2U4kcNxakmBjt4oGZlibTR5ikxYhlUuRNka2wblHiN+wL8z9Ggum:3zug758kkEiXjOAprX2wd5WjguGOK","tlshash":"50f3f8e83995f6666eb30277009f1803737c262b280d4d60a211fd9eb5b845eb17bfd9","size":172834,"data":"","first_seen":"2025-01-18T11:47:06.649614Z","last_seen":"2026-07-03T17:33:04.056394Z","times_seen":3950,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/283.72ad89d50e47a681.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a573528e998f7ecdb0cbf8bf54fa6146","sha1":"c9809881c0d52e725c1fc40c43c85dc9c409fa50","sha256":"f885496a63600baf165fcaf76407811f84d2c37b9fb721022034a6a0dceea60f","sha512":"be65b3ff7043728db90ac8d04eb03ea78e74b7d3a81ade237749370e891837805c299d61a5f83d97b4edb4feec026e9a4197a5ebfb503a8f9b2887c9ca0cacf8","ssdeep":"1536:J9vESgOX7fVPPWPsQG/+f46KbWNvuHjcGc7tPuycVdj13:o+fVP+gEKbQAcGMgyczjd","tlshash":"02d32ce83993f561abb611a7405f2813733e2a1b2c0d4960e111fd9e74b405eb1bbf9e","size":134345,"data":"","first_seen":"2026-07-01T04:27:05.854983Z","last_seen":"2026-07-01T04:39:09.925608Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/b536a0f1.1249f719d932f90b.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8d1a34d70f4e7b723342d4f8881923","sha1":"a298a99d4ad29b7c42c98d5bff697adeb8ac2655","sha256":"6404d6a8cc44d9181cbb433fa67059a54f43e6ba4fb0df7927e7869432b6450e","sha512":"3930807c1d1dfb1c1b2b5c5de8d7b684ab4ef506cabad4434e251c1c23352a1a66aab490e6db1463556fa72d642df7255df294bbdb0fe62c4946bce6e5c76783","ssdeep":"12288:n9zr4NWWrJmF5SUzWexaCyEM2H+IlQcUcb/:cWWrJmF5SUzWexaCyEM2H+RcUcb/","tlshash":"1de44bf53271b0134b5b909754ba0443a329b4db380d857cba2ca4dbb4e498972fbfb5","size":684155,"data":"","first_seen":"2024-10-25T15:55:06.811839Z","last_seen":"2026-07-01T04:39:09.93953Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/main-app-0137294a834688e0.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"674de07a5e67d435c4318dc8ecbb2267","sha1":"a47390cfb08798e186f67b2e744d7e49d7510f53","sha256":"b61987fb4d69e9a05583064a2ee3cd0c5163554b5721b479cce21b902cef028c","sha512":"227f87f7beb6297d892eb4a4935e9dbba9db79d46d68376695bf9773c3736b58cc084de417dd7e7d47ad58fa71aae7714c1c19399dfcf4bc8985c7c9791f0020","ssdeep":"","tlshash":"1ff082992b4c702f3913ad24fdd35c2e355e817428a718501a04ddb12c33ba8e3f1c38","size":461,"data":"","first_seen":"2026-07-01T04:27:05.837225Z","last_seen":"2026-07-01T04:39:09.912998Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_014.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.608Z","timestamp":1782880719608,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_014.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"a790-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8oQRTM%2BcypDOt%2Bq3mEKyxQ4YxYUHxuIYUz5K4QducLS%2FJnI%2B2G%2Bbm%2F%2BpxcnTRXeAUjvFJFUaleSkpVXmHzH4lgUpPPiZYQoS2%2BYXiUWMb1JsiA6Ow49lUQtMyFJZW2v8\"}]}\r\ncontent-length: 42896\r\ncf-ray: a142b8f19c8b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42896,"size_decoded":43605,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"a18ec5096b69c0793648a234d207c0c4","sha1":"8db026ecf4603f5bf22810da93a03a41999f22e4","sha256":"3ea712b0356d96b3d837f62487ea7d6e4a95285332d1bee389cb9ed5be5a0cda","sha512":"6b2d604463aa69b90730e15dc3f0e1435927791e7f73714aaeb1f2917854709af0d98f0662d49482360c22f5cbd245aa4f68cf582db99d8bd37cda7b4e03349f","ssdeep":"768:ZbiweN3X8XVdV4vZXFip8/EjGFbzNGa7ebTTOOyZs1DAlM0wDJJ:tpeN8ldVO1I8/hpfebTqzME2lJ","tlshash":"0813f16998fbda0d099857bf830e229408b9c9b345679cbd58a1b0cef9f31335331667","first_seen":"2026-07-01T04:27:05.822748Z","last_seen":"2026-07-01T04:39:09.900332Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_019.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.620Z","timestamp":1782880719620,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_019.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"b2e6-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BXcE33Rkx5dFttIY5ooaKQrRN0C79zHAaa%2BNLiSqXQylMTdQxz4PKEa7f5ZJl0i0c0XGdH1lUZQKWl57oZDuJ7l5ET%2B60LZ%2BCedkMu%2BwTO1Cg%2BIEb7y3S4duVSXuageJ\"}]}\r\ncontent-length: 45798\r\ncf-ray: a142b8f1ac9156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45798,"size_decoded":46501,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"595562ba5568448c509d1213135214f1","sha1":"7327391c6f7d55cb7fa21d9b1b2944b9a860080b","sha256":"9de13c9aea666d391031910bc9e285029775d2b536822516c441e79889c02b82","sha512":"21de9bda7aedb6c20dc70530715ffd82a2d2540d2860d807680f462277c3dda7eb39692de4af36ad0ef2c49bfeca65d4cdf52ca6dd0ea30f318f5ec8968d6a36","ssdeep":"768:3wn7YzVl1dZlVw23HyCf2uZZQU6z12yR+Zs9iP/8GzkEVmcZRuf+v8SRrppM2M:35ZvXnfxZQUemj//4EEff+vTRrlM","tlshash":"d523e08a61fcdb86ee7ba4b78dc86f4304b7218b4180614dd65038ad2912e7deb76093","first_seen":"2026-07-01T04:27:05.830889Z","last_seen":"2026-07-01T04:39:09.901024Z","times_seen":2,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_023.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.625Z","timestamp":1782880719625,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_023.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"be77-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T1PUJ8EeY3E6T9OVytky90Bc5JC%2FAwU0J1AvcnkX1RhcRPOgysZwrYOBB%2Fi0tCcCU1F%2FJ0HV2e7nlXonZOe0t7Hm8XFPV5nAk0x%2BywyBPvkfumT1MTUAfOEha8lOcXd6\"}]}\r\ncontent-length: 48759\r\ncf-ray: a142b8f1ac9556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48759,"size_decoded":49460,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"a7e69e629287d975af2a69ea347bb128","sha1":"1da2fc2c1869a77a906f50f7b68447c7b4b8a556","sha256":"850c5d7ab3bb04170533da09dc49929f60d9ad6266cc14877f36b428d293faa2","sha512":"2ea1478a521d6ce7f6a7ec7fc538a849fed7997d067f54bedfd3a0d242fc74fa8e1e135c57e6e3f2b332d47535236c016ae1266a46bbd61c238b104484f047bb","ssdeep":"768:20JJYfG+G86zYOWyMRk1H6m2O9/X1/vbNshhstmtyMND2lSlF8RBl8880J2OElfd:3JYfvPOWyM+1avO9vdpyhswyMUtZK0sV","tlshash":"1323df1aa7708c91b0ad82ff7feb8e8ba17985c34e76904c7763b61a56464f053520cf","first_seen":"2026-07-01T04:27:05.791715Z","last_seen":"2026-07-01T04:39:09.901728Z","times_seen":2,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_016.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.530Z","timestamp":1782880719530,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_016.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"eaca-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vMklmwonjCPLflmY2kuaDwOn4Bnt1w74edE91L4ik1WD2%2BSr3BUWcWn%2BqsKqjRXmr8hhm0ocTYhw3ErNwvhr8APDE3wcSb5Yf2EJgzcnr9djxeUO8Zb6gWkV1fyvGdJW\"}]}\r\ncontent-length: 60106\r\ncf-ray: a142b8f11c6b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60106,"size_decoded":60803,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"eb5eaf06a875d2e75e8b30a217aac5ae","sha1":"be9df1e86ed1828e9f0a5452acbc88c26a0155dc","sha256":"7d858bec922871795a7881e0392717ab42be7c6fe0588e4587e6326fba326256","sha512":"ba7600a5a6d8ac8276f6cc7359c8ff2e5e63a8ca634ed18a64ccc0ec5c20a948af7cef6bb78be4d3d5c34842640e6a7d72df4fd6ef1f3ca6e7aad29e2c0a0e02","ssdeep":"1536:+CAX1g+H/g/p7TeQKgB16XbtX1s85REeCpqiCVhuXrfyqGeh:lAld8ubXbtls85spqiC0qqGeh","tlshash":"6443f1a5c9fdf4095ec764484272bb9a07eeca61b998a37cd8d7b441ee431ac4c1503e","first_seen":"2026-07-01T04:27:05.844294Z","last_seen":"2026-07-01T04:39:09.902687Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_021.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.544Z","timestamp":1782880719544,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_021.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"f1cd-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ywL7GpI2GDySydhJTKldxd2q0E5cBDELT5wH1e7bx%2FG1AOvRxNQL27XvKGC2Lm6LdYYVyvbQrRVuY4AkFxFoCHF7jYeDlwod%2BnqF1SCc9P02LcKx5IYvEyfLwBxldU8b\"}]}\r\ncontent-length: 61901\r\ncf-ray: a142b8f12c7156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":61901,"size_decoded":62598,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"4f286572c29295742994256428360475","sha1":"6d80db1b172bb2e0ab2c19f2e66336eae02b7973","sha256":"1c59239483aabf6c41c22c41add74b9b3ada983340e375f3d90e0e95b3944e8d","sha512":"71a6ab760f303991642847a89e8b5c47c9f779e5f8a0f6d48bc2b78c4d0d32d1ff9b3ac743086047ae8718053adead188bad51c44516ee4a1de4ff320c559733","ssdeep":"1536:DAkIV2AE2RSRSW6Gc0HGD7SYUUs4QUNjJyDuddKhTDeJzdr:skIV2AEYHp0qmYjsajJLqhn+r","tlshash":"2853f2bc84f82c056b847bbbb814053f85b1afab1e12696b24def4095605f6b43af447","first_seen":"2026-07-01T04:27:05.82017Z","last_seen":"2026-07-01T04:39:09.903322Z","times_seen":2,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_028.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.632Z","timestamp":1782880719632,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_028.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"c63a-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=piwv236eou%2FyP%2FybZ%2Bes9Tp0siVGPLgw20UefubpAUZdyN5zFChrJb6iBFr1CkaLceEugsH3omb%2FtZtc%2Fk9zQ9Qok6a6l4wNCwaPHNhhbBMZ6wpIzGQg2Aj6sYzkwh%2Fw\"}]}\r\ncontent-length: 50746\r\ncf-ray: a142b8f1bc9a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50746,"size_decoded":51451,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"4d5e2398b65f6fd0bd72cb9147b2aaca","sha1":"ad992f3ab5df23fcfaa235c3fe3004058e830235","sha256":"04d596e631aff20bdb4203762781b5fa7930067f8b36973f9a4aced4ddffc920","sha512":"f7aabf8c783f8aca6c5636404e47b0f60cc4793011f4b4a6c5ea0b2bed0f867be6940bc50939dffe8c4af50e02a66283a653e1be2f65e355f483732907526543","ssdeep":"1536:2GqYp8Xvq3MZHgYbepVhUdk//54HkpGl65fCozRv:2fYi5HgY4Vhp/B4HCV5fdN","tlshash":"8833e0084964d45d4ef62a7d373906bdaa14e033c1c82625037daf19a926f0cdd2ee7f","first_seen":"2026-07-01T04:27:05.839174Z","last_seen":"2026-07-01T04:39:09.904174Z","times_seen":2,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_015.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.528Z","timestamp":1782880719528,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_015.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"e2d3-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=904kF8WK6cCTnQ%2FbXtIVggJDcuRfLioJ%2BtgmccAS8L2h10AWVFJD0Ilg%2BTDzaRQbHPfioS%2F1i2zLYPz84qi0U8TuYYIJCudvazf3NCtHekd0lzQV2QKApLF4xjtCegZN\"}]}\r\ncontent-length: 58067\r\ncf-ray: a142b8f11c6a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58067,"size_decoded":58768,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"be3c45a41ab25e004d07a36f827dddd1","sha1":"befe839f9e3acc69c2f7dcfc604c1f97a1b98487","sha256":"04a4224ac90598749801b404f97dc8947cee5e4d9f9fd66b6240607d9d12793d","sha512":"70b32fc5b3c8c29ce56bf83dec9f387770509cf81d55f4562b34a0550b6da022beb9a3103ee6fc9edd5bc31cf54859668ae7794bf0e5fe4c887ed28cabb9f08b","ssdeep":"1536:HvTkV5qbxHtwmKSnZUEsODjC25tHi2tSVsNVxyG/O:HISHtvnKFejLTCsSuPUwO","tlshash":"ab43f1fde1d7a08cfed92e12cb34a0d3924c5270aa6731873b0855858fda9782626d0f","first_seen":"2026-07-01T04:27:05.7894Z","last_seen":"2026-07-01T04:39:09.905868Z","times_seen":2,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_019.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.537Z","timestamp":1782880719537,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_019.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"f1a2-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lva%2B1IEXx22Z3fSR1OhBHhqR3ALdFOmWAendc86V9bw7Ira7ef6coPJrF975Tcs1r4dxpWF3qpikGMZgw6BrPafzJv6pVd%2FK1cPc%2FwCNfd6tJ7ro7yzq%2FbBaLAngVR3L\"}]}\r\ncontent-length: 61858\r\ncf-ray: a142b8f11c6f56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":61858,"size_decoded":62559,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"eb6f65515ef1cae19c3555e7f6968263","sha1":"a435b8f566595178edd9e8db2beb150d27b3ecfd","sha256":"72c90ddeb154b5747d9642135e4ecf2363342d4518ba0494b0afbcf5574756b2","sha512":"5a45b207a9f575c05d26a5789c3c6027e8e65ce5d4518a60a6c120d51ed5405fc09e89ed2c97c7b3051fca181b98dbb233bfacdc48564b71f9333647fce60dd3","ssdeep":"1536:G5Q3pEa1aEXOAcWfTQGyUNTWGXR5ykur+oK+:G5Q2aLNzkzUNTWGh5huNK+","tlshash":"cf53f14c10f6af068e772ebb43080ed5e6af705f221648b94334fd5f49982e75651b43","first_seen":"2026-07-01T04:27:05.83381Z","last_seen":"2026-07-01T04:39:09.906433Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_002.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.573Z","timestamp":1782880719573,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_002.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"ad41-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PhFvESEwycLCGAkZsIykWGJ6aOg5s1BKGeWDAFEvpJIJDlClw%2F1gYWZeQaY3uO0T2DbPgJhE%2FEf3nMSHf0gNpiLhkL8e2GbZd0jTjwSlx3smGIQVaPCVBi3tyUDjtJ4t\"}]}\r\ncontent-length: 44353\r\ncf-ray: a142b8f15c7e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44353,"size_decoded":45050,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"d08894041b989e153c7eaf06e7c28b7d","sha1":"ee3218040b526c0cbb3a1885d31b095823352fb9","sha256":"b176bb57711213596012d9aba149daf57a993f5701bcbe63742e15202099588f","sha512":"d20da68728980c5845b267aeff4fc382c3cac941d0a81b12b6ea63d525e993378042f3e22250df7cc0bdee7229d41466a52dc9601208296f79cce536ec15b865","ssdeep":"768:TONYOCt1uRQFpayNtep/oXsb/ZVYME0SYX8ncparCDDFLeysUW1Z:TOyPt1uRQw/3bxNwcMrkpLeys31Z","tlshash":"0613f1363438f0875e634e389af14f46c5d72083d5c42568d6e92e8f8d11c8aae6df2d","first_seen":"2026-07-01T04:27:05.842071Z","last_seen":"2026-07-01T04:39:09.90695Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_004.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.576Z","timestamp":1782880719576,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_004.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"a9c3-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0O4X32PGMhBfWtXKHAA4qmodTTbquTmiOms6sRItFR7tN2vcLgAJ1KwVu58k0jVlz8gbE744D9G3%2FrF0O3S312EcD2twaJLewaBbx%2B60bHHEO%2B720CyC05ilm4%2FINktw\"}]}\r\ncontent-length: 43459\r\ncf-ray: a142b8f15c7f56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43459,"size_decoded":44160,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"a6a1ccc34fbfb2b72bc47722a3fa8887","sha1":"269e50fb746ce1bd89eae8a6926ad2f76ac8b546","sha256":"80fd6a5dfaf31087e02fdbb9207e5eac352a2a185cb8768189fb4ac60e2ffe1a","sha512":"a4be687d7ce5792558dd7a30334faa2d797053941a076e46e119875a1a7c1e4d7d471edd44b7ee86ee78e86d4e9ffc51f2b1df116c340c9d39112eedea4071d8","ssdeep":"768:o2jv80IN79ZRW9nVvpVO5o3vfUlhv2lFpM3Ae4MNfuTIfhcHCc:o8v8NMVRV9vfAhvEF67Zzw","tlshash":"5813e1ad143bce944d0bda6cc65e404b72c0884d07d2fb320ee98eddc565aee62895cb","first_seen":"2026-07-01T04:27:05.845513Z","last_seen":"2026-07-01T04:39:09.907541Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_018.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.618Z","timestamp":1782880719618,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_018.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"af32-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Whw1mP0bL7pZmJgmu8lF98tmZPqXDDzaFP%2FrgaCpu8LnCwrKQbx6DomYnfZLOOiFWr1zv4M3tnXUdZ0BXzoi1Mwb4ynkP38FPPDgxS18PktAIecjLgCdzewUZJgkFbpo\"}]}\r\ncontent-length: 44850\r\ncf-ray: a142b8f1ac9056a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44850,"size_decoded":45545,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"efc3c76c9035588f2fbf014dae13c82e","sha1":"767091963e5b790a341834f391054dfeb6d400c7","sha256":"495e493ce64fa43d65369d57d71d9f1d6fd1e5dc170e96e7e453bafd724285c1","sha512":"c8b0b0383a2a7eb16271b47e5ab616e8f410d5458de1b85461ce57e597a0e87eaa3d255a2b35db1525ca509561707829d3ac7a88312cb39ae126bc20c662d125","ssdeep":"768:g9j+dNV8Pz7Hzl+Hh4VYSZ7Fe8HNQJb719/POSKSRtBBqP0IoeFBC:gt+bGLzIHh8LpoGsbDOete84C","tlshash":"2913f18ec2f30a54aef28d21d0980b1d4b1d768fe61a7d7409b688fd1db3d7d81521ae","first_seen":"2026-07-01T04:27:05.858881Z","last_seen":"2026-07-01T04:39:09.90809Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_025.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.628Z","timestamp":1782880719628,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_025.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"c1a5-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B9m7hCr%2FubFS%2FAoynjWdHpG5Y6Z%2BR35CNy0miM0D7n5%2BPuMf8jIGjqTK5vP7crEYfse80PUQ10IDDF3W9jVCnkY8EwNTJSOI04g0MRM3arbynhQujo5AVstXWprhNaeu\"}]}\r\ncontent-length: 49573\r\ncf-ray: a142b8f1ac9756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49573,"size_decoded":50274,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"a991578b446630790bfbda7712dcbc81","sha1":"d4cef4fff5d370b1b36204a1f087443808db5a49","sha256":"425709c5ffd28352193abd864094e56cb636faae63707d4dbb290f4d1461a25d","sha512":"7c67c22c2fb761e3d61106fcac9e3fa67ccd44f5078f5e712e10cdb6911bb8a2cf28e6c75b599302046124904c4fbbe7cb6ed6a293669acdd9d25c8ce848f808","ssdeep":"1536:FnfADTSFcT0qcm3Pg1ZQmowvb/TBqgOd1AFf:FoqcHPx6xqgVFf","tlshash":"5023e15d27b6f94c49e621bb6fa400b95bb2e2dbc45558ec52723a843d02235cf1ccaf","first_seen":"2026-07-01T04:27:05.880659Z","last_seen":"2026-07-01T04:39:09.909031Z","times_seen":2,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_013.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.522Z","timestamp":1782880719522,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_013.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"e09d-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=078d0scFEN2Kmn06Yq%2Bh9SnS8mqgqZPg%2F%2F7IevX9HszAg2dfyOHr4QsZfCeiVDBKcbUZMvTavWXcJB1Y50a3xcQKNDI3eF30R7O%2FkJokn5VvzVD%2FdJ7dkJyTFl3rzKOq\"}]}\r\ncontent-length: 57501\r\ncf-ray: a142b8f10c6856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57501,"size_decoded":58204,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"23e5578b498d6de672a40f2b46c8fd28","sha1":"684af0fc5f23d93dd7632923fdef2982bdb29be5","sha256":"88429a9f9661c4d103a3a94e34ac382ddc135a3617480c8ac21ab2589b2ea9ae","sha512":"53297d584d3c6daa12cac810de7f0ad99c79cfd187022a3719ef80b1daeed2c20652d6cd1f086708153cbf91ec27637d5da53b08094b06dd065133a452182fa3","ssdeep":"768:o58b5bF1h5hghGBAnbTHuDHM8sv7SES0lnzBNU5RfXCzqgaF43togKVTwZL0wcwT:5kpcHpsXlfCIzqgm43SgKCZOcs+","tlshash":"be43f1a968ddec8cd64781de3e98c45efb5914174a5910e2872bfe1596ecf08ec38423","first_seen":"2026-07-01T04:27:05.838145Z","last_seen":"2026-07-01T04:39:09.909534Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/media/7be269dd6123b082-s.p.woff2","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.260Z","timestamp":1782880719260,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/media/7be269dd6123b082-s.p.woff2 HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://evil-corp.app/login\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"14cc-19f154b1cb8\"\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KFu79Tv6C5PFEvFASNpd8rg5B%2Bhlb%2B2meGJpNh6aEz%2BDo0vWWZ5NLyeRhFFiSPq9oqfUo1zjFIczPN596SVWWLJOYXl2pUVBMmsSoD5imVRT11ujcHgp6gp1hqe2loI1\"}]}\r\ncontent-length: 5324\r\ncf-ray: a142b8ef6c4956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5324,"size_decoded":6046,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 5324, version 1.0","md5":"517d60c144b454663ca2b0df15047f76","sha1":"e7be1052a0f954137167472679e0b938b81aceb1","sha256":"4188276a58108d04eb0c6f5b8c9e4b5ac2d9e31e81b2b4fa7da263b92f1b35c3","sha512":"4c44b61548e0189f5b0c44da6b5356d2aea37230b8bb077a5c3145dd62612e86eae900a9b902a8d48942903003e0f78d60f0a21efe469b4b8622b7159d520aca","ssdeep":"96:R9Ug7Ii6PmAmQLiG1U2J/ZA1nEj7flZFaK1UHBDdtbXWZyV9MvwRXfZtMq:R9UkIi6WZGm27lLR0dtjKQMvSZx","tlshash":"f4b19e4c8ed42540c0931abc4c34389cdf5846a9647c9ad7c50c66bb4b2e717a8af5d5","first_seen":"2026-04-26T14:24:56.338508Z","last_seen":"2026-07-01T04:39:09.910103Z","times_seen":5,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_006.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.504Z","timestamp":1782880719504,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_006.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"e4ed-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1yGj7XeuvrJBOcRPekHipZvNQknzfVa9svbsFLW16l23wEYnD7Jor0yRTaLE38mbglqaRqQG4eJ3YXXFAOV5ctHwyITEi%2BMr29MK%2BH6ctVTMPDOlXdFEzONrM5BjnuRr\"}]}\r\ncontent-length: 58605\r\ncf-ray: a142b8f0ec5e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58605,"size_decoded":59302,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"784b703bcc5bbc54424c249cd25ea71b","sha1":"14cfccc6c41cd837b23500bb1a5903cd5bfbcd0d","sha256":"9f230b38d8ddfcfdbc350e53bedbf733d78ecd538e32c651f9c1d6923aa39894","sha512":"3596a0bb03eb635aa52a620bf60f93f9f202a1f85dd052d611923f330ceb08fc375975a1409c5120b1e91775edf83c615a0fd396df84b4b512c77b312df4b19f","ssdeep":"1536:Jv+dsTSmKWBDb0hTCZcPKUHriuOZAdbWaCGNjB:x+gSmrRbuCZcRLiufzjB","tlshash":"024302bb8a24af20cd6e5939ed744be14d2d9c736b0d75ada686ecd891043c1360c1db","first_seen":"2026-07-01T04:27:05.854116Z","last_seen":"2026-07-01T04:39:09.910678Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_031.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.570Z","timestamp":1782880719570,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_031.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"105f5-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1uKAaMjagSAVbVXCCHvTmtqTCjFIkndBotJfIa%2FrjJIFJOBTV1piw5VdqIoneEGvvwEC789WZ5FppJcDjZoeHeoFFOtw2%2FpVTYMi9K2fFIC%2FP6WKIvGAsfm2%2FTqb%2BWNH\"}]}\r\ncontent-length: 67061\r\ncf-ray: a142b8f15c7b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67061,"size_decoded":67765,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"e178b92825eeec5766e0cba67330bdfd","sha1":"a4d2645d4351b590d77b9a5d3c14f880cc9909a7","sha256":"d273fbc00fe4b5ae09866c33143916a135b6669d03dcf4de94ed9ac1b3e80bf5","sha512":"4605a8f706dfde466db3110eb9b9b940c7e7154d7940df5081dfe51efef6f562dd8b47cd7176a54d766ad833e4a6e3e1d7b7ff5e7cd27292ddf9a6daf2248166","ssdeep":"1536:qlgS/t8adIToBYd6B+3U9WcM13pjiwzLL/dDl1ZEnykULNqRq:q/tjIToBY0PMlpjian/N1EnykU5Iq","tlshash":"4a63021ff240da77c91f0a35a33b9887c5eaec3a010a67853fdb170c78a6939404b6d6","first_seen":"2026-07-01T04:27:05.841149Z","last_seen":"2026-07-01T04:39:09.911434Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_009.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.512Z","timestamp":1782880719512,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_009.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"e3f6-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TJWqQjPaD%2F4uBRMQ2lou5ay2RN9qtDYwIr0K91Kll5%2BRk6wis58vcGI%2FloNUUqWlW6uAAn6dJjtBYpDbrqCMA8GGYhAx4pZ6C6PE83YRuxYv1afFjhWL1R3lwoK8ok25\"}]}\r\ncontent-length: 58358\r\ncf-ray: a142b8f0fc6356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58358,"size_decoded":59057,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"cadb581efc64d64688dcec03e1dc6941","sha1":"480ceab22e4dc2218be6c7cda3024f0dc79790df","sha256":"30f34b2fc89332634caed5ebe082ce8fec28885e8814b519ae53a3af75deda73","sha512":"5eef6b07a0cd7191e00d7a4ac842abd5e291877b0953bdb23f6e449dce2a2801c12ba8cbb21e62cb655334817eb7af5ad794113e9d78cea37b9acabb729befaa","ssdeep":"768:a/Xdr/Fg6LuJSOggEj1mhOrgHZBX5P6VpYU/G+e7GB983JQqYw7/UTZTOKS9oaN:KM6LuL6mMg5BX5PopreyB9YZ//wS9oaN","tlshash":"b443f1d852949c12ef6dc66bfa3099391a8bbb36c8044853cf61fd061143d7f6f79a82","first_seen":"2026-07-01T04:27:05.795043Z","last_seen":"2026-07-01T04:39:09.911989Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/117-5fd6584fc4366ff5.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.272Z","timestamp":1782880719272,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/117-5fd6584fc4366ff5.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"1e5cc-19f154b1cba\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RUKVCAgbqBFFgorDL%2Bn%2FnTEokQ1obEAOAsvZcg6EsWjQ7s7f3qRqkcKZozWlFaIP3lGeUiiJN%2FXq5bPK%2FoJu0cM8JLqIKCtz6aYRpItjvogAeIyjOmUfmI%2FufX4prQwL\"}]}\r\ncf-ray: a142b8ef7c4e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":124364,"size_decoded":32621,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d13e87eb771cb1dc6c862544c92dd720","sha1":"846bf0013f880dd962a499008ad7b3c7fba8937f","sha256":"7bd6f41cfe0ce8b68c0fcfc0c580bf3f21c9d7b49f22665e6b21bb5ef49b476a","sha512":"1ba96f22742f8333dbe47235b5a037bb8c4764d0554ab1d6d1edad2fc722d6dbbdef50f5c89cb5daa9f8f6e684bcf53db54a3a7e237b1ed218b832bb75d809a7","ssdeep":"768:fO9P55e7wbSlPftVDK//d9icrEAKH1ag8xxqKjj3fOpDKdlr/NaO8Qr93UsGoROz:Ugw2l+Wc3mY5jFdl/iPsibn2kJ51oCv7","tlshash":"bcc3d8ba71d0f8e2079744e5843b400af3791c3b146f70a0a7a5cdd9b5a44eea1a3f5e","first_seen":"2025-12-16T15:37:48.63769Z","last_seen":"2026-07-03T14:21:30.949943Z","times_seen":1919,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/main-app-0137294a834688e0.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.274Z","timestamp":1782880719274,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/main-app-0137294a834688e0.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9fnu1tcmaxGzQghoHrdGfkBt%2BQYHGeL%2B7IdwrnAVA5doi19THbkS%2FEXYHxB2wPNwoLFk41MOTM40i4eK4sibblUAEzPJfCBvhfxZcIyD4uddlSqcbpUcTKCol6f3z9Vb\"}]}\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"1cd-19f154b1cb8\"\r\nvary: Accept-Encoding\r\nage: 731\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\ncf-ray: a142b8ef7c4f56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":461,"size_decoded":958,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (461), with no line terminators","md5":"674de07a5e67d435c4318dc8ecbb2267","sha1":"a47390cfb08798e186f67b2e744d7e49d7510f53","sha256":"b61987fb4d69e9a05583064a2ee3cd0c5163554b5721b479cce21b902cef028c","sha512":"227f87f7beb6297d892eb4a4935e9dbba9db79d46d68376695bf9773c3736b58cc084de417dd7e7d47ad58fa71aae7714c1c19399dfcf4bc8985c7c9791f0020","ssdeep":"","tlshash":"1ff082992b4c702f3913ad24fdd35c2e355e817428a718501a04ddb12c33ba8e3f1c38","first_seen":"2026-07-01T04:27:05.837225Z","last_seen":"2026-07-01T04:39:09.912998Z","times_seen":2,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_027.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.561Z","timestamp":1782880719561,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_027.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"ff9d-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LQx39cS08aoEuE6dBD1kdJ16Q%2BuuxkD2i3%2Bhy4YS1HNMswx8uCrwHfDcqGUN7qKpP6zzWMP0NC6T4A2vxOrY5nncRpYow1Qqh9CZqTxq71gPEkPOPUbXisrnV%2FT2VBqD\"}]}\r\ncontent-length: 65437\r\ncf-ray: a142b8f14c7756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65437,"size_decoded":66136,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"88d3fdac0cdb846a1d564b4efd84378a","sha1":"92792b9b9bfdd757bfbcdb87d8fdc57513038328","sha256":"381842ccc47f6fb258882912c68dff5677e8bb34a45b878baec3e27ee8a80ab6","sha512":"24c1ca57ae6308c91b55870633d56abf3468a3dd1ffe52205b6fe44efd7f2d4dbf0222bbd3c2adff32f5a3f5d5b54b9a57d72b8da5843e1c12fd0462eb8d7fd8","ssdeep":"1536:8UvkE/G84prA/4sl3K4LwX2CbuiV805HIF4epYEVU7DDQv61na:b/n4prAgd4LwAgv5HICepYBDQga","tlshash":"d55302e0460ffba5c6f8278d9ab46e11fef5d6605707069123b28b472f4942f29c49f4","first_seen":"2026-07-01T04:27:05.856941Z","last_seen":"2026-07-01T04:39:09.914045Z","times_seen":2,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_012.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.606Z","timestamp":1782880719606,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_012.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"a4b2-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ciM%2FmWr20uEEsgOoW7JpRCcg1LBNFVO7YGLtxPG%2Bo8ZCwvTQ68%2B8nSGYN7RTydimf2gz0Najp7oavOo5Uilt%2FxQLVUiLm2QgUaBRi1w4NXPOxY8jEEwSjo67ECSOQS4E\"}]}\r\ncontent-length: 42162\r\ncf-ray: a142b8f18c8856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42162,"size_decoded":42863,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"bf21f9f5022fe6f6c87982f1dbee8998","sha1":"6442ec745eee6ad33de2031911c1a9388c66374c","sha256":"c824a83a566933a76f873b1e047d38fe32b91cefe2ccac6d77856ae64dac5b52","sha512":"3b30a3b52976ce9f068937c85970fb4169f8c79213158a161bbda5ea9097b0e20614beded0d828e87aec0169289c5c2e55527b94903cc6aa1937f687bc2ec597","ssdeep":"768:QLBsxiZLPCZ/vrAyG+4fab6Dmy71qQJEC3TFOhIjCUSb3rTTGHYWOhkvJpp8:Qzdwrs+4famj5t3TIhKCUa64ghpp8","tlshash":"7b13f1eac92f5180df5f292b664247792a29b37465787bf0c0701f4a84335dd8ae4d3e","first_seen":"2026-07-01T04:27:05.799875Z","last_seen":"2026-07-01T04:39:09.914592Z","times_seen":2,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/webpack-448b85f7147e06be.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.268Z","timestamp":1782880719268,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/webpack-448b85f7147e06be.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"fb2-19f154b1cba\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pYimUGmEKqMkFBga8HVgTVLf61qOKrPVz6Wbd7YfZ3G2%2Fn1QYTSQYY87uMabvXvgiQp0X3pzbaFR2R6tHRDO7fGb4S31SeSbDa6YNrfRiBoWgyYfJvsUIUeruW%2Bklssr\"}]}\r\ncf-ray: a142b8ef7c4c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4018,"size_decoded":2745,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (4018), with no line terminators","md5":"02e1104110c8927ddc798e6a0b037951","sha1":"db429d7e5d5a580741611652689d3adabaf35620","sha256":"1ca7bc35f9a4643e78e8b8d6351e0250bd0188deea947121f7cf62c3955e74c9","sha512":"4ababfb1a58cd53fa294e733c6b0e1902267aa11162b086075a5895d8026853f2489274030853ae1031e973ffadf90cf627679f8521b7fb7846de42a3456aa27","ssdeep":"","tlshash":"248175de32a4f979179398a1043fa557f23e14b2282ed0a0db19d8f5bc745498523fe8","first_seen":"2026-07-01T04:27:05.860708Z","last_seen":"2026-07-01T04:39:09.915226Z","times_seen":2,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_028.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.563Z","timestamp":1782880719563,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_028.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"10190-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nLm6%2B4Ef5z0wCItCMMUoqofnsY6dBPRuW3ryFLi%2FAUr20s9At%2FQXBK%2FU96ZNnF0%2BsdG4b6Q7LmjojtOiXDcPJuvkYJJDYCQcsWR97F63xG8ONgW%2F0U6qgo%2BxlxcpQMKm\"}]}\r\ncontent-length: 65936\r\ncf-ray: a142b8f14c7856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65936,"size_decoded":66644,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"c52393457ca088f277e7b436ec58c2b9","sha1":"082da9a5cace1c9b9ce292db10473d322554c3c3","sha256":"138ba12f51e018dba942812c151a968cd13f0b7457edbb07324554ce84b187a2","sha512":"bcc788732c3b8e272aa86be06a39ff2cd4375973bbef68fc49d62a67a0c63acf1f4d5e394d65dc429e2455c04de8f51a831d6880874d33cce43d7773d718baf1","ssdeep":"1536:Za/qkXAI9zYKWyeRFDp0vxrrr8lFvu+iS2HzU:ZqqcAI9s5FpWrWFvcS2Q","tlshash":"1d5301956289cbdfea0d7161ce40acc12e1fa92171818b84753026772b7f12f6c749bf","first_seen":"2026-07-01T04:27:05.8474Z","last_seen":"2026-07-01T04:39:09.916187Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_017.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.617Z","timestamp":1782880719617,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_017.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"b203-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xmX0cR%2Bk%2B2eufbWW5q4eCCgX1wqXV1qLZBtG2PFC%2Beh3XzvVYwfU0TqxC5oSj5kTn6JGquSKSGgwxKFD446d5LPX0R9mIVU5qV3wQDKjT04B03MIHBn3zuIVJyy4pLfY\"}]}\r\ncontent-length: 45571\r\ncf-ray: a142b8f19c8f56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45571,"size_decoded":46270,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"b43687288a2cdf095cacbb2c594e82c1","sha1":"d44737a440ad9e25ca432ba5d6e1a4be2f6983ed","sha256":"dcab83cd1c44a969677eac463a84c8286247a751f3596c31411786466651bda3","sha512":"2bf45c3297b6cc81fe8bfff4d2e1eeae1041083c08be501ea76ffbebb5afcea2a92eb8618c42f0855098ea9d67a0e81ba85116a5b90f6cdc680545e1afb84845","ssdeep":"768:1EBK1LzARQX57dZPQdFbW9GWSbAVvyg+BjZIfQXGyuOIxhVC2uw1IfTPPvn:1qK1LCg57dKdxWgWauvygUNuyIzYwwTn","tlshash":"9023e0a025b1e9231c87a37abccc4f5f563b3016a4fe90f4d11a5f2c9226e9e0d55e47","first_seen":"2026-07-01T04:27:05.825527Z","last_seen":"2026-07-01T04:39:09.916739Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/media/463dafcda517f24f-s.p.woff","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.258Z","timestamp":1782880719258,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/media/463dafcda517f24f-s.p.woff HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://evil-corp.app/login\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: font/woff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"10918-19f154b1cb8\"\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JKtx3cNAK82BwwTPEWQ3Wyj7llBsX%2BUqS5tOUqr3iZ0YhIvgTgShkJg2ZnbtiS32RpERzXuXtXxno%2FYhh9dpmmkCM4gOm64WN6PdCIJJY46WSDFKlZqwy89nCs6s5hWg\"}]}\r\ncontent-length: 67864\r\ncf-ray: a142b8ef5c4856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67864,"size_decoded":68585,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 67864, version 0.0","md5":"cbeb6d2d96eaa268b4b5beb0b46d9632","sha1":"fd8c986a8767d59a36e2d194299466720c916ee2","sha256":"e8b65928f551b17e3d67c3f709721b952c39842d14b00701f9232057fde73608","sha512":"0828401dbc56e8a3343958d9b38d64115de040417f108a10d8ccdb0281ac2dd785eeb634c0affc2e255d291970b70c682a22384ae9a4c45208d560b0813b839a","ssdeep":"1536:J/BT12BbemOlLQucYMXTGJ2JwkhNa+62xmFXENn4qD:J/l1abevLlMqUxhNjSXENn7","tlshash":"2463f19f8d54c168dcc8763ee0a65b412f882f03c1dde8e5121d6284278a55b7acf37e","first_seen":"2024-10-03T01:19:04Z","last_seen":"2026-07-03T20:19:15.468722Z","times_seen":1753,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/css/f643c52d51207515.css","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.263Z","timestamp":1782880719263,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/css/f643c52d51207515.css HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"861-19f154b1cbb\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xDr2vltQm%2FRtTdOFsOvrRv51%2FPU5M1njMnMEpwrsa8%2BFkDtFD18oV4wwcZOHDSLF8kNl1K86LIfwIH1%2BAqCo0MyCwkZ4km7mq2G0l68kAdGP1mjAxq2bh7bkUtlUkAQD\"}]}\r\ncf-ray: a142b8ef6c4a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2145,"size_decoded":1442,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (2145), with no line terminators","md5":"acddca2ba031fd865c75fee7b22c5769","sha1":"1c7a1063c8089b990782b762d3c9d0456ab8d03f","sha256":"4ce88939cc8eea29f51547f6d6afb06bd4a434cd262a02de3188cee57839c736","sha512":"7bcb03136ae1762710addb02fc142e865345288b5203bdc6d9227d43c92ca744ce0db9bec2ec8c70afb47862dc218579323e950fedd0bc9cecc64c61d3837830","ssdeep":"","tlshash":"e941c024c02a806ee476bc9333cd7b13256d181173d90526ea1e95a99edf827b3b1b68","first_seen":"2026-07-01T04:27:05.863135Z","last_seen":"2026-07-01T04:39:09.917791Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_002.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.495Z","timestamp":1782880719495,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_002.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"e13d-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NWF0iaItGwC8CMJuygGhWiRwFdvuO7HdmnQYpsBMqrDWedeBqodsG64iHSl%2FtBxiI6Sm2vDK9NY6LyHr%2FkB92e%2B42ZWmabL6j0SXTRXbiPThI%2BplCHWQmSH%2FYGPpOQdK\"}]}\r\ncontent-length: 57661\r\ncf-ray: a142b8f0dc5a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":57661,"size_decoded":58364,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"fe1f5a2eabcb5897dba8754d525cb211","sha1":"1f483670bb40b9d4b3bfcacd089b7154341a8b12","sha256":"bbcd2ef162f7e97336bf07823dce97442562dde72da789949002fa5539d52ce5","sha512":"d22931b7e73063654a9cdaf637fbf2e2a7211b3ad35ba02de918d80174cee55c218b86d6addfe02c495b85c1c5e8a4c2dd5be4cb248352933b8fb5bc33d613d8","ssdeep":"1536:LTxn5NSXdUg/YqlYoYj1iVXkBa+Mxc0EstQQArq+:L55SUg/lkx+kEvcGNAG+","tlshash":"bb43f1e5d0ed38c27d4e9d30bc9bdd4e0de4a6ad5c762180b6e4a364a2c09a4de14ec7","first_seen":"2026-07-01T04:27:05.874394Z","last_seen":"2026-07-01T04:39:09.918397Z","times_seen":2,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_003.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.497Z","timestamp":1782880719497,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_003.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"dc6a-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9A9tC2HjfidFUSXOOHmCekylDviM6bBpLY0hm0O0aTy9K%2By%2BmkxPzQWB%2BfGS7gGdR4XZMMXshkX%2BQ3k7niXvIQS8ziD1PmWgZ1CJrRv%2FseJ%2BeMEYRUZ%2BUB1sGmTSURJS\"}]}\r\ncontent-length: 56426\r\ncf-ray: a142b8f0dc5b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56426,"size_decoded":57133,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"58fb16e705edcb3678ef5d9bd7ae7cb4","sha1":"620fde4597cf00123a01a2716ed5e8618ba11b3a","sha256":"d2a8f4cbd445dc160fb3333cd7571085683dec42cfbfe482b6db59dbf6e2be59","sha512":"ec5cfe06433ad7865bff30cb316eed65beec693870359d2c79858620f321139b38207497181c0005ac94e726379b79f9e65863f01e1b11b23b0c821336f9cdf0","ssdeep":"1536:s47iY7GEUmCjXjuAVNNuP31srduXbNYB4t4rl7I3In94i:yXLtN431quXBCrl83S94i","tlshash":"b64301d0b278e4a10405e1bc3cdafea7399b515996fe9d7fc206944540e1c93a90d9f3","first_seen":"2026-07-01T04:27:05.828788Z","last_seen":"2026-07-01T04:39:09.918965Z","times_seen":2,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_010.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.514Z","timestamp":1782880719514,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_010.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"e707-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ci3jr1iQGyQhmCvXcxNYc104iPxYOf09%2B2dDwDsL3IV9py4r4NdJGBVXqLF2Hno%2FQ7U%2Fvu2NdmKVbwYhWIwAfRl2goF1uqidglAwQdfHvvvo5m9MMunHE7gYth6kkStB\"}]}\r\ncontent-length: 59143\r\ncf-ray: a142b8f0fc6456a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":59143,"size_decoded":59842,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"598af82e2dfa816ffbc90fb9222a0b66","sha1":"0ce229316f781cdcd9faff4e44e313c3240b96f4","sha256":"ad5334a00deb06a781d7aae7c4478950ec9ffb36f267458e9423d39556972e66","sha512":"9b3442ec5de1ed100b13b32740940281ee9e2a3c675f5d0f65b1d4fd53bdeae56c9c6d3b028c47372d46a0d1d40db43631d3364a452b66ec076ea21ebeef9e13","ssdeep":"1536:sVUvL33ZDqiXPbGG3TkqjoQHojn9nX4dio:sGrZDqiX6GpoQHoKio","tlshash":"3f4302ece5b41ae5264a44bfddeebb8f111e81876c7fa0b98e010d6a7c34d0512d64e3","first_seen":"2026-07-01T04:27:05.879824Z","last_seen":"2026-07-01T04:39:09.919489Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_020.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.540Z","timestamp":1782880719540,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_020.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"ef6c-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WggTSpRAdl970YDZoUi7ewKjpwtafL9crr3j97%2BVjStURjMqVOQTK2Khl667%2FhAcAiHIksbvi7EvWwPVSMs03yHuN9jyndomnZoDPxZaqQNfLr6Xa%2F%2BNk1lwIqyEmSLU\"}]}\r\ncontent-length: 61292\r\ncf-ray: a142b8f12c7056a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":61292,"size_decoded":61993,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"dc09b8887a1264b66d2f4f6ce554fc0b","sha1":"c5d257cd43440e537482f954d9f69071e965a0e7","sha256":"e63d34bd1a12ae2e11857d656998acd1cf2fdf6868cef260645f360e83b629cd","sha512":"779aaf27e99543908870b2662585b8050b15cee4b71501a674ef2bceb67fa7444d4086d99e9ff5f2c350f81b17708753568bd54c181ed291d540d3bc16f19617","ssdeep":"1536:dV8psWleT91YKA/0oyic/mu09Zb8YBG25IOEMdvW:dV8p3cT91YKA8Jic/mu09Z9G2SReW","tlshash":"ab53f1ecca714104a0d315f2a111a3e6e4a71c8fb9a15066dfcbf13e28534bead7598b","first_seen":"2026-07-01T04:27:05.849892Z","last_seen":"2026-07-01T04:39:09.920282Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_003.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.574Z","timestamp":1782880719574,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_003.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"a383-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KRXcfgwbzJ4cTk%2FidxHF3qIY6jHS4MCEhLVnWDGEpFiyV73EtwkgqOazEnnuvvO2tLlJa%2BMEmvZQ6YGJBFTcpV0gFYyp5BH9ZIgRkrFHRwOn2cdpk2ibAXc2IberJjN1\"}]}\r\ncontent-length: 41859\r\ncf-ray: a142b8f15c7d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41859,"size_decoded":42556,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"800ad6ac55e460a1ee7fa1987a04026a","sha1":"d6e9733e866b6992fd0e2d3ad3fbd4b127b89ddd","sha256":"fd4a13e91f55600bb5261d4d5b6bf3cb967fa00c6b96a53885cb4efbc7d934aa","sha512":"e9847aa10cc4789be6844663691028bb15178fcd316d6bbf83da0efba0438fd13dff7af11e4ee5b9f7e6ae31db806a62586db6eab5bfe66c3ca3b531fc347414","ssdeep":"768:fzH/oiPoPYg+vsKuSKEhR64niMSP9pgkAnrm4YN/fnG8gZIwSgLApN5Qda19vyAc:rfLgPL+vs0/64iMSP9pg164Y9XgZI4L7","tlshash":"5d13e119117fc860fd9795bb00cc924bd634692b682cdb3d2534292eed280f9d297be7","first_seen":"2026-07-01T04:27:05.859887Z","last_seen":"2026-07-01T04:39:09.920832Z","times_seen":2,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/app/login/page-2721a7bb6040fd8d.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.276Z","timestamp":1782880719276,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/app/login/page-2721a7bb6040fd8d.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"3e55-19f154b1cba\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UNWyK1T9dr9xnSHLoIhJHtggsoiLBoNdbqgFH4Vv%2B7qEmIFi8n6V9g7x6O8S4T832Ec8m9yG5B1hGQu19RMe9HSFh93a4FR0rxWZ5pLp%2B6GI1OOu9QopkrlmcdaZ8brI\"}]}\r\ncf-ray: a142b8ef7c5056a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15957,"size_decoded":6754,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (15926), with no line terminators","md5":"624bd3524b551332c88c110c8e30644d","sha1":"8fc3206a76b6d90231b0763d8783ce23bff8af04","sha256":"ec54750a5f9c9e103d657df155bdc86b5435682278c9462caa7076cce914d8b6","sha512":"6004b2915ea76075cc4669a48c822f2cbadb0daef6c754c5df42466e2d263278b4b21efc02e1e376127cff2d280b5e8f7b127cff21ec9b3f4606cec666a61d1e","ssdeep":"192:JlXsZTdU0oMtfewCfXYhDJzy4geLngAFb3d9Im0q8e81vRE6bbqDDv6:J4pU0o6wfXY64d9Im0q8e87EuWDW","tlshash":"8662f9613653befcf67a046850bf800c716f7f68980b4814f3b86c122a564d5f6e6fa8","first_seen":"2026-07-01T04:27:05.85593Z","last_seen":"2026-07-01T04:39:09.921438Z","times_seen":2,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_008.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.509Z","timestamp":1782880719509,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_008.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"e720-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OelRNc3HO4oE5ahffPSOeWGpEa7fIKUJifsdfT5tqIrQszHO7RLeg2gCH4BpHYI4vQ%2BBqqSSMytQUAgqBUli%2BKk7ZsINtfv1Do8hX6YgzK7Ppn%2FxGEBZvjAmxbYiHiW8\"}]}\r\ncontent-length: 59168\r\ncf-ray: a142b8f0fc6256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":59168,"size_decoded":59867,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"0da62312d9b3f73979f15c14fc18cd91","sha1":"930b168b684f7dc1ae5f905dc45ec511fc058657","sha256":"deb542f0099abdab0221706ecd8848fa593c4814171acae86d008fc9331730b4","sha512":"3c98afdee1ea71f90ff82d0a7e8322169fc03c54ed6dee07e7e61f9cebf32eb60e2ba5479e84657f63e652f457a5cc354167feffbfed76cbfd3a2cb4d136a830","ssdeep":"1536:tnjq8tMz9GOvTUcgSOhupvOKZYavY3XjjDg74m+H/lRmQk:tnjq8tMpGP3jgaflTk","tlshash":"0d43f15130b685650a4c0e7deca05ffecbf1a5b458a709f70fd2b7eca0a17813a059b9","first_seen":"2026-07-01T04:27:05.848985Z","last_seen":"2026-07-01T04:39:09.922021Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":101,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/favicon.ico","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.406Z","timestamp":1782880719406,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/x-icon\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 11:34:40 GMT\r\netag: W/\"4ad-19efe8f8880\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QyS8BVj%2FPG6RpeGdfRdp%2FlmOsgSgquS0MbBznkeCWd6Ze8GFsE%2FPDdNRBtLsBZ19e%2FD4lLOohw8ef4%2BEXXvC6B2h2dOSnWIt8Aa5J1og28E9VSAWMRhNRXp4BXOHT80h\"}]}\r\ncf-ray: a142b8f04c5656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1197,"size_decoded":1947,"mime_type":"image/x-icon","magic":"PNG image data, 57 x 57, 8-bit colormap, non-interlaced","md5":"3972b213264643479c5fef018ed70317","sha1":"f671dbdd2997849a3db5ae88b0019d0bb6ea5ce3","sha256":"b5b22df488dc85d10745cb1195d861023338b267b1924409537b5bd6faf7966c","sha512":"b35540e04fcd5633f54b1d9b5553e7ae26704f257de4f5de9b3d07b3cac08f84c13e5e7ef6b51097874cc4a8d6856d3d7443722569b0e02529cb0d98ae54661c","ssdeep":"","tlshash":"7d21daf6862affaa00de9218f0b923c0942c54693541085cc3adc51d1e5a75013f99ff","first_seen":"2026-07-01T04:27:05.878901Z","last_seen":"2026-07-01T04:39:09.922961Z","times_seen":2,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":76,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_017.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.533Z","timestamp":1782880719533,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_017.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"ed13-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yjOw7iQopBNBKmo8x%2BJ3PV4g6n4tOM9IYnc69r6RWl0aNqSycUDepiZVF8JRVauQyL%2BfvtsuMLXN3BOeHsFpKS94EMIrXgEXC3kplHxLsKEqsq6ApnPr60HT6xQwI0SC\"}]}\r\ncontent-length: 60691\r\ncf-ray: a142b8f11c6d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60691,"size_decoded":61388,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"b11b8488181bcbce4cb025ec0c1fe27f","sha1":"52b9ed1659b3bc76e6e9130ada779ab400dfe1ac","sha256":"ad38ad6fe307a88c892299673d564a98d9f489c08979b6921b1a8a9c714b26b2","sha512":"572e7707322379c6bbc87e16702a58c177f328a06cf56733fa41dc95cc918662bce6f69e6aa6cd64f466aed6af95decb7b7af70c5c60c5db1647f639390857fa","ssdeep":"1536:0euflAo/MdNiqgzPUWnQ3xSp1gphQKXiJJwvrWEr:eflAo/G0nQmKdE2WEr","tlshash":"5e5301943cb47e30984144efe8d812ead78fba5ee43c8775d8033621814e76e9ae0997","first_seen":"2026-07-01T04:27:05.830064Z","last_seen":"2026-07-01T04:39:09.923508Z","times_seen":2,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":89,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_018.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.535Z","timestamp":1782880719535,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_018.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"f175-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3T%2FMUiz202CILBSCqBJdi%2FzWVyp%2FcMAGDfL4dmDfIysFqQGIDoSpt%2B6RBbr%2BA8bFqZag0W7Kv8n7fxO3bwu4xxLguLCIm%2BTtxnQ%2BhQIA7s1Om43gA%2BN6tAZJK%2FOPGuEd\"}]}\r\ncontent-length: 61813\r\ncf-ray: a142b8f11c6e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":61813,"size_decoded":62524,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"6397eae9ec3ae2012ee6c2d1e4597b7f","sha1":"b2c8e9c6ef8df454c7ed1ae0284e979d2aa51dcf","sha256":"57eb5744546bb001d8e19a784e51a1458ffd8f0bc723d01dc20abe051174c149","sha512":"294f3d4cc000ead2d0401f983230ac94a215dfbeadf3a318045f08240250c5c2b1a6176d78e35c92569164e5cd49e5421f751da74bda5d29d6b7b32efc0091ee","ssdeep":"768:Qb/Tw2vxtZOr2fpZmeidz3OA3a+lJwvUaEfTHCTf9mK67dVQS+KLwjYmB:k/TDvxtZOrap4hla+lJm2TCTL1XbB","tlshash":"d453022a542f8be477f620b38619663264728b433155113dd39fb4c0c65a33aefa06ef","first_seen":"2026-07-01T04:27:05.862187Z","last_seen":"2026-07-01T04:39:09.924Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_005.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.578Z","timestamp":1782880719578,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_005.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"aa3b-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IV0ddK9fCBq6K0RGTZycXp8zkKsB3ZYx9fN8QJzI4Hvhu3%2BtietLDYPUadgj3tPF2sKlkdtR9qwJtPqD5ofxk5iSn1Y2R1eC2y5pct2PRxEqHIabDeqZoZYwS7cMpk7S\"}]}\r\ncontent-length: 43579\r\ncf-ray: a142b8f15c8056a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43579,"size_decoded":44274,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"87e2e2fde0d0be8005ae106c3fdc2bfb","sha1":"94ebbed8377a58eeb33f879cad7e16634b92a1f4","sha256":"34398d5a6cfe7a2be8e4bde74e70ee9e064739e9a50c0561d42185ca2377ba68","sha512":"b9b95d7743290d660b01556e1ecc883ba8b76e6d9107a8ef4d17f61130be8260c6e67b48d3d6342a94c7c78944f6026345f33998987593d8f895c5773b608650","ssdeep":"768:THBIQg3yRASpek2COtpR853sFUuQw3ZxNvGE8dxhiPhiMXBVDy/wgdDfnWu9wvdz:THBILiVEkGRw3UUcZxNvsnczyxdTWu98","tlshash":"0d13f1e8d9112885d76f62393441ed6688326582e3c7419c08faa05bfc26d6cd4ffdae","first_seen":"2026-07-01T04:27:05.801995Z","last_seen":"2026-07-01T04:39:09.924564Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_013.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.607Z","timestamp":1782880719607,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_013.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"aea8-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CPqbznSThzP3WlBzaGP9ujINeLMF8PKv%2FpzZcnVo0W%2BKbyfFyhIvIRCUBG4quoy%2F%2Fpe4IEhsqvUqC9yK7NJswUaUC90uUty%2FfmlQ68CWwcdCHkIPnjUNnU%2BfYmYT4CKt\"}]}\r\ncontent-length: 44712\r\ncf-ray: a142b8f18c8956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44712,"size_decoded":45417,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"c6c834686b50a6c5e468542dd1d73e62","sha1":"3e6dee1d49aa715737276e7bac10580ce04de41f","sha256":"a6d13bfcf29eff15e418308aaed34a4e421463c0fdf9a07bac06e9105de651e5","sha512":"86fc38281b73f014bff6d1b69a9d2b9f63c2ef38746c5fdc6d72ba35a72730dbbcf6013227cebd5ebb3cdaa249e8a2c8c7e34327c690fa32c2b6c44c0290d410","ssdeep":"768:Y8/X5LIHQ6kl5dKJSrSXBLRmP065q7D4XWQonNwworLi7y7pfsIRlQBlNXKDlDLs:YgpLOQFqnm842wWQaNwZrLiW7p0IzmN9","tlshash":"9e13d022c4b4d503dedb91b04bc41f8722f311263bc39749eef9b12b1842e3d88a99c9","first_seen":"2026-07-01T04:27:05.850812Z","last_seen":"2026-07-01T04:39:09.925108Z","times_seen":2,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":100,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/283.72ad89d50e47a681.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.609Z","timestamp":1782880719609,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/283.72ad89d50e47a681.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"20cc9-19f154b1cbb\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tGmRuimCPxOFHN9tbwGO2F6J9jbiXbIJrJT2w86az079Vn5CnOXKK9p86HlfCDhDgeY5KxUvCRSEustvCAPfDUvrPF35%2B9jokOrgYD73GGYv3k7Sojfme7M4Cj92sY6s\"}]}\r\ncf-ray: a142b8f19c8c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":134345,"size_decoded":44085,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a573528e998f7ecdb0cbf8bf54fa6146","sha1":"c9809881c0d52e725c1fc40c43c85dc9c409fa50","sha256":"f885496a63600baf165fcaf76407811f84d2c37b9fb721022034a6a0dceea60f","sha512":"be65b3ff7043728db90ac8d04eb03ea78e74b7d3a81ade237749370e891837805c299d61a5f83d97b4edb4feec026e9a4197a5ebfb503a8f9b2887c9ca0cacf8","ssdeep":"1536:J9vESgOX7fVPPWPsQG/+f46KbWNvuHjcGc7tPuycVdj13:o+fVP+gEKbQAcGMgyczjd","tlshash":"02d32ce83993f561abb611a7405f2813733e2a1b2c0d4960e111fd9e74b405eb1bbf9e","first_seen":"2026-07-01T04:27:05.854983Z","last_seen":"2026-07-01T04:39:09.925608Z","times_seen":2,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_029.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.633Z","timestamp":1782880719633,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_029.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"c7ba-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4QZPdoMoRDzFQwl5DG60FyiVEMtJ1vhivKbsN%2FiyGd4YTXJULVsHVPiTvFi3Afqyvhe4P%2BVVls4DuCyGqhEWj6CuFP%2F83CD%2BpfhwP49uRMu70B%2FvRt2p91B8rQRC8OnN\"}]}\r\ncontent-length: 51130\r\ncf-ray: a142b8f1bc9b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51130,"size_decoded":51833,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"a3fd06bddfdcc9abf9504695d550ba11","sha1":"99295576adfd1c84643f27ccf24abe46d840cadc","sha256":"b2857f76a42568fb7f5441d19f64fd9706422f931039853e62d5f101619dce31","sha512":"9a10dec362f7d6eec355c5add0b89aec0068080878152a169091047d812ab4f499176f7ac41bd36519181af16386ae0fa800911335d1435c4064fb7852bf4367","ssdeep":"768:QnbtV+jPVGglPtNbE2XTam5BHtRjRoqMWjGMRORxYEXFf4Ox+gOT8gT9ZU3:Qb3291PvE4XNhRoqMYGtrfAvRT8gT03","tlshash":"7d33e0141835e30982ec283dbfe8493b9359e6a3d9bdc978c0bd52871f169a0cd9dd2d","first_seen":"2026-07-01T04:27:05.877919Z","last_seen":"2026-07-01T04:39:09.926094Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_001.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.493Z","timestamp":1782880719493,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_001.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"d9ac-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PQwA58wp857EpaM59iXKXoxAqBiHi7TWt1DTK1aeb8tDa94tC4bL5i2bTuxmOaJWqIoo7wVu7Ij8X6jPcck3SsCU5FiDSotNg2OSDqXcNkRR%2FLZEViRHNzGOGBV6gfme\"}]}\r\ncontent-length: 55724\r\ncf-ray: a142b8f0dc5956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":55724,"size_decoded":56419,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"f6452aac38e7d09302bf433c90f67116","sha1":"2e4c4130185415f30b56bd42289e62fffcb1f6b7","sha256":"741163ad551418faba287c1c46be9a10f96487e491657f8c97d8663cbed4387f","sha512":"008ff5f09d2ce84d0bfbb60d00b76d1e8b19d1336bd61dde4244673e370eed5bf23985514a30e268c68a1ad375ab43a36013fdc2de53a24c5dfcc369a6b77b96","ssdeep":"1536:AmJfvbhszfEOW/ud6VhGi69qmav102S4OcNFkq:7vuTi/xVhI9AvLS47NFkq","tlshash":"7843f1068cb422e6fc743837116dac9853f9397b288b4d7d69da79fc6d04a6f072a443","first_seen":"2026-07-01T04:27:05.817511Z","last_seen":"2026-07-01T04:39:09.926724Z","times_seen":2,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_011.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.517Z","timestamp":1782880719517,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_011.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"e505-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8DIw7SV2DpHcraezUapqBh2vfcDf%2BVqisJJg2fD5%2B44ScJS1Dmb6PL4kyzwU7DgNGui%2FfcmefyMpp48x9QR2%2FtwF1Jwqs4%2FZRKzScU6JnB%2BzSO%2FbqeZLJnC8lgIWOKQR\"}]}\r\ncontent-length: 58629\r\ncf-ray: a142b8f0fc6656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58629,"size_decoded":59336,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"78e48c72dda7f3d3e08514a02a2f0249","sha1":"859e3eb6bcf8e741429b78fcad9c681b0cb9d475","sha256":"428250ba358f9bff595cf5dce37f874ff36ef3f4242ddb06c2fd4c73948b73f4","sha512":"f473f9fbad00970cd179bc200051bc0506d67a5b827dd6867f9b76d8380e7c4d38345d489f882defaeb666f6b87b8156fbf767a6ca97798e910f3920d1501733","ssdeep":"1536:401fttMlz7lY66c+xBtFrH3anSKPw0E5h:401fttA7lY66NhD3kHPw0ET","tlshash":"fd4312df16e27a17300279e3442d132a27b0e54bb5bd26ced40c755abf8d47893ad263","first_seen":"2026-07-01T04:27:05.826967Z","last_seen":"2026-07-01T04:39:09.927245Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_022.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.624Z","timestamp":1782880719624,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_022.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"be93-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w3mOjYxmOiuPxue8ogQPXMaJN80o7Xgqp0DkYCDx9rN1qahHDinfoZuybX1wNUFW%2FOb6B0EmD0EI2IooPatPV8Yvh1uXS1bwKEe6ugoll1pIbRGl5G%2FkXj6mNbjQpcRf\"}]}\r\ncontent-length: 48787\r\ncf-ray: a142b8f1ac9456a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48787,"size_decoded":49484,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"9b43f722e1a9233a7ca60422226b7eb4","sha1":"18f8940203423d4f9e1ad5c2f45ad1b5b94f31ba","sha256":"8071659e27dce1395e406861eb1dc511bdeb6dbff59a63a83ba293c86648e176","sha512":"2c1a230ccffcc260cb131c5ca3a13fb43d1f5e7d733e46f9b5b45616508e0058b5272dd31f9e6971bf91c15655d78dbf48ed45c7a3bc9dc1fe16eeea3f454e17","ssdeep":"768:pmFRHOsJu9RkO0+LCHg/7fNlGBQTzq7Wy4eo9pJyPxSVm6TZqRIc+9PfS5GRqm:YFR7GgCCHg/7FlGBSzq7lVILyPmqPif/","tlshash":"3923e0aaa9ff5e082ccb04fb04196185dbf66eef6b0b605f9522f449d85ccb4270091f","first_seen":"2026-07-01T04:27:05.823749Z","last_seen":"2026-07-01T04:39:09.927784Z","times_seen":2,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":87,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_024.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.627Z","timestamp":1782880719627,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_024.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"bf17-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F5Hi%2FnNxbvt3afmzkTJpljJ1Msk5VLgGA4PccTHuFOCnLSa8EUMYrCeRiRWBxPZpNeSohF2s%2FFzkdGxHTxwHztg6fsUmYhT%2BgLyLUHxRQMNNwbqJEnER4PhrOftnY%2Fc9\"}]}\r\ncontent-length: 48919\r\ncf-ray: a142b8f1ac9656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48919,"size_decoded":49622,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"134386d5197ce2b168856f46443ce717","sha1":"ee5bb58bc98b4965eac417f336f2f05319ba8ef1","sha256":"282f73b2b562130dbd5fd2e2478e68bb6b864879219f314f14f72f879ff27768","sha512":"be616799333314dbcc3b19c6dacb6ae7c5875b69ffd7aa9858eb807b3992b06f02ef98d2f1ba9cd9fe213218a9042f07774c7f693d0c87121b45a92be0290270","ssdeep":"768:uYVecIMvTp9/Sk5PTnLmop8DqiY/dBMxCSIfDUvUVDIKZUn4td9v7y:v9IMvTp9/raD3GdmxCSIfwMVDIKEUdl+","tlshash":"8423f10ec8f9eebe7ede68b3e59d209497366d434443285e2c10bf105e9067e4b5264f","first_seen":"2026-07-01T04:27:05.870014Z","last_seen":"2026-07-01T04:39:09.928293Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_026.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.629Z","timestamp":1782880719629,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_026.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"c443-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0i%2BE%2FHDqm7%2F5uSmufW2BkvT0IxQVpQtC27oRfmVCbJ4KdMeceQEqG72lSpiMskkzEdW%2FinHOckAfRSp73xqXDCc87YvGQztatnngIrPmEWM1PmXVIZCkHg0%2F4wQr8lpS\"}]}\r\ncontent-length: 50243\r\ncf-ray: a142b8f1bc9856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50243,"size_decoded":50946,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"266ea6de80b40bc2dd955ce463fb59ce","sha1":"b22e23d1ed0be57f9a3ba699da05a61dfe725142","sha256":"a9e480aa12b50dd3c5177e935c4bbd167f119c7cec5377f568322fed37490d37","sha512":"7e7c60c04e6bf169017590373a3921965cbd95f0f2e72acde949107736358d620171e84d690871f01c9ad59757c7ebf363d2eaa9a743ad26e363081843cb0d78","ssdeep":"768:iBBZ9ug47fStCnkzQ1YHoiWZV9a2aXeFwXaneV/0N0O2Z+nFUkNlrd:oYgeStmkztEZjhaXAwXaneR0uO6YFUgZ","tlshash":"b833e15eeec4d24d3ceb65bc976888f1cb81d102da4938142992a9291d4a6fddcdfc3c","first_seen":"2026-07-01T04:27:05.835743Z","last_seen":"2026-07-01T04:39:09.92882Z","times_seen":2,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_014.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.525Z","timestamp":1782880719525,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_014.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"dc75-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3Agn57J9eBzVoLzyEPhFjQwOVkA%2BznmTwpUA8g0FbImoJwAWFOwA%2FvoISuAlrnUnJR%2FNfYDEX2hd1YTEcWtj174j%2Bk2zjOK3RXK35Zvpb7OjdjT6IXYzV4f67DhgnpAd\"}]}\r\ncontent-length: 56437\r\ncf-ray: a142b8f10c6956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56437,"size_decoded":57138,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"d501a8826d034530c566dcd9df668c18","sha1":"3fe3058a661b955e3788b57b295bb335cc1dc51c","sha256":"28a020581cea36cdfb4444b49b15790ff32ad564b2776c9c4351b04984b98914","sha512":"d885ea8e62326e8aecd2126bd05586ffbc1c01e43afa7c8d4060c86b034c1785ba63bf43434ce36350959cd0ae51aaae5372716a4ce926bb2e7a11e368b92102","ssdeep":"1536:5W6YwQmlUBCzyIqkBySn6KrDc5bsImGwB:5W67QGUBTIquym3cMGwB","tlshash":"2a430131ab7f8ce2bbb5797b69116a35203269131c510bbd636031e10dc3c3a47cea43","first_seen":"2026-07-01T04:27:05.87089Z","last_seen":"2026-07-01T04:39:09.929372Z","times_seen":2,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_025.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.554Z","timestamp":1782880719554,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_025.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"fb31-19efe3ba3f0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jLpfhTNz%2BgZj6nIfzrfc8XBdQJmLf8w5ickG%2FszPM40sIxY9%2Fz%2B8oJfdlGtKGUtqtKHAy%2FNZonhrD%2Bxeao2Vs961DPMStXBw0a1COZh7kMASX7bd4jnwPx6me7GJlx7A\"}]}\r\ncontent-length: 64305\r\ncf-ray: a142b8f13c7556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":64305,"size_decoded":65007,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"dd6a5a3988f4b2966ea21568543a4e7f","sha1":"332ca5957cc8eb2dd55f6a1c33f2a8d2c8ad2be2","sha256":"f8ffa65067c176f69b3bdf9f8180c093f98d3765a1c1cd8542e4ef169868de07","sha512":"348281ed0f6f689856546a7716deb5c49cd954d54675334c431df71b00171de936a0c3ae6c2d991d285df166750e80d6ede21b33e81f20e15dc59293250ec67e","ssdeep":"1536:WocAS1StC5ADlw3/CzCo10UJWux3qI7yhYDrDwa4EcDtKw03:3cAhYADlw3r1ux/egwx703","tlshash":"ec5302225025792fdbf9a3199bb71c797bf05119c0822d53825dcd86072d2bfaf12a45","first_seen":"2026-07-01T04:27:05.80096Z","last_seen":"2026-07-01T04:39:09.92989Z","times_seen":2,"resource_available":false,"data":null}},"time_used":115,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_005.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.501Z","timestamp":1782880719501,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_005.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"da3c-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JQX0UuocMgMkyIjswUG%2FjM0hxresIu6YqFfNt%2FcZBS6kyLn9TR9D7vmAx9mnDvMkslyTzJhMIcuVFNYyU57sQ3O1pFlpa0NRY4QKAhVMLe7jdSZikNZhK4hgfkBb2wIn\"}]}\r\ncontent-length: 55868\r\ncf-ray: a142b8f0ec5d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":55868,"size_decoded":56565,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"7e082785a26c04bb77c80a994b3b32c2","sha1":"97433c28e1e0e00af32b84db0c65ed0d423ea1ba","sha256":"7f17d723961c1e12e1ba0872b7d5894e1f39edeb22aa42de479231dc90f38761","sha512":"68f930575b4eeea5f3aa1fe099a687bf8674b3128040b679dacb32cba449910ac55660b355694b7c4140d30b9bab21b3ae029f8b7a6aa83fef729b0bc486ea8d","ssdeep":"768:yTCiaIRvqlTyYylHQX8Pjyi317XlIXzf4DXrlTKCmwnMeOowyZ+vI1:4AvysC9WXUXywn/OoHgg1","tlshash":"4943f1bf851c4ae92c088d10f536e5aecc91cda61c8652eebb44ec4b7603c9ee971d53","first_seen":"2026-07-01T04:27:05.832918Z","last_seen":"2026-07-01T04:39:09.930372Z","times_seen":2,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_022.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.545Z","timestamp":1782880719545,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_022.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"f542-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LNX2%2FD4FGDzh%2B2R7UzUUR8H5s1%2BCf%2BuQ%2FlniKQLV1vvs1Mogxbs0h%2Ft1oqw1JLcMiJpWF81QcM%2FeNi7HAikYwnoFHrNE5%2BnZiw44rrTUGuWJa1ED3bWA9yPKn3ao6EEX\"}]}\r\ncontent-length: 62786\r\ncf-ray: a142b8f12c7256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62786,"size_decoded":63495,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"3c4e2be2723321630186b5101cf7bb30","sha1":"5901b3ea626aa270847f3f3e054a066d9cf9c4bd","sha256":"89271f09fa48d48c43cad732dfaea371734f1648b2f7a832f2ddc740e6baf800","sha512":"01b0b0d71642b724b7c3e2b41a9e63101dc4ad672b0128bdb0d0c651e2e38be98b41d76e213f41d340342192d6ef5b8bcb58c37d75385eab3398ab95f796a42f","ssdeep":"1536:5x1vtcUPiQP4vIScLjA9zCLTuRr6k/6SCz3aTK9b5FuEd:5x15nwkjAC+r7Vu9b5xd","tlshash":"495301d115b5e731e1268c73d41321fb0aa68abbe060842ec5fedd1a71e05721fe21ab","first_seen":"2026-07-01T04:27:05.875297Z","last_seen":"2026-07-01T04:39:09.930936Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_023.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.549Z","timestamp":1782880719549,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_023.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"f5ff-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CgQjIc1Cc4bZDVLmjrBgSgcMXJOGWoTjpwm%2FG6xnBEoirvMbpKndVuUvWXW2QWzQcCBxA9lnbOLLyO2G6Fb6rdUudetD8ZaXVRchJhfpDIIwWSkBnuW3bNi7Cq8%2Bzq%2B4\"}]}\r\ncontent-length: 62975\r\ncf-ray: a142b8f13c7356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":62975,"size_decoded":63674,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"fdcadba9c84d76bf2bfcab9078293d9b","sha1":"61c1f8c2fcc0b1a2f7e0c3d881eff39c8137d02d","sha256":"e2ccacedaabc3c01e4f0e7bbd8ff2665de43c97ce6c73ccc729b9e0b2602f42f","sha512":"23b40e09d639e0b93b184072e99055319c6de063ea7ee6c66ff26079037e19c803548d472a11cdf756d60a57044fbcec3520cb968cb54016a0bc91517e7c1e42","ssdeep":"1536:Wj1Td+as7VD7t52g4Zz6sovzu9JJRA7RioWTuSDNu9b9Gk:WWhOxovz0JJR4ioWiSDs/Gk","tlshash":"ff53f1d8476dc642caf0ed1b3a65edccd97e20232ad8903c3991ba684072175a77c9df","first_seen":"2026-07-01T04:27:05.821225Z","last_seen":"2026-07-01T04:39:09.93146Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/testosterone.mp3","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.639Z","timestamp":1782880719639,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /testosterone.mp3 HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: text/html; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\nvary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding\r\nlink: \u003c/_next/static/media/2210cbd8019a9e5e-s.p.woff2\u003e; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff2\", \u003c/_next/static/media/427e4a37d3642943-s.p.woff2\u003e; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff2\", \u003c/_next/static/media/4473ecc91f70f139-s.p.woff\u003e; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff\", \u003c/_next/static/media/463dafcda517f24f-s.p.woff\u003e; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff\", \u003c/_next/static/media/7be269dd6123b082-s.p.woff2\u003e; rel=preload; as=\"font\"; crossorigin=\"\"; type=\"font/woff2\"\r\nx-powered-by: Next.js\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9oK8fwG8VFB3427HIDpoKKF1i72z215ZhS9a3zAGZt7pjh24X6gLc%2Forywu8hKM%2F2mpmNw06hKSuHOaH0Ie43brEYvBCqr8QkjdPkVyw%2F1DiQFU68105biu7XC8jzQAE\"}]}\r\ncf-cache-status: BYPASS\r\ncf-ray: a142b8f1cc9d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]}],"data":{"size":7574,"size_decoded":8849,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (7574), with no line terminators","md5":"4ebff5e7f8e35ea3cf1661eb0f24e0c8","sha1":"1bb5fc9e2bca049c17346fce820e38963ffc399b","sha256":"786a7938d1a35a7c64c9ef661d92f381481e2a9ebb736e0893f4eedda8758569","sha512":"52280ae462870e0af2b9d9ecf301b5ba0694ceffb4e4d0b3f4c4b8aa577288de47a9bca27968ce8c399507c96550739b0da7f6e6cae287087efb548e0e1cc271","ssdeep":"192:LqBHUOpt9nvaWSzHkrtuNgnqzcJmkqzto:LC0OhvaWTkEco","tlshash":"2ef17239b805ed4bec6a7c1d117e6d3a50cd897e47e599b887cccf0509820ba2b97ec0","first_seen":"2026-07-01T04:39:09.931927Z","last_seen":"2026-07-01T04:39:09.931927Z","times_seen":1,"resource_available":false,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-01T04:38:38.719Z","timestamp":1782880718719,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 307 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:38 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=0,i\r\nlocation: /login\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jf5Gl2mxrNZEt2Nh%2FS5mG9ycFcvDYgRMTH%2BfBJuLY6k2J%2BO2Qaugh2XP4SggQ5DtZb3Dbp0jGS0PG7GSo1cMDwrEWdv8h1faun8MzWW%2F5bTxCbRm7okqQehZAlOHHN2S\"}]}\r\ncf-ray: a142b8ec5c3456a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-03T20:16:42.123945Z","times_seen":16949822,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":37,"connect":17,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/media/2210cbd8019a9e5e-s.p.woff2","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.249Z","timestamp":1782880719249,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/media/2210cbd8019a9e5e-s.p.woff2 HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://evil-corp.app/login\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"57e0-19f154b1cb8\"\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CDTDrv5c6EPoc6dbvUi%2BfOlmxF9M9HDTi2942N3TIWkKgTBhmjEbzTu5wb881qhhMnYk%2FhBbAtLIGAyX5PyO5En2EzTybYOYiK5P1rHrzQ3yp07ugmeD%2BXRkNZO1LgBa\"}]}\r\ncontent-length: 22496\r\ncf-ray: a142b8ef5c4556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22496,"size_decoded":23219,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), CFF, length 22496, version 1.0","md5":"26f15bf263599d05a557257aeb83ab4b","sha1":"eb1be954297e413ed22bf5b2aa59b80c207c2fc6","sha256":"5b4fed1daa90708aa9c6ee1190abca9dc22164a1c1def0020386e46b61038cfb","sha512":"088fdca5ef54b4edba4b7d5b1b5d27958a8b09ede7c88448b827adf5ed3e91ec47947c66a10469a2adac87a840f1e44fb9b46c329410011d12a28c0e14bffbb0","ssdeep":"384:HvVb6bFbzg6HrHoDh3IouCLk/I0z4bnJHCeqtyTWIPq7jZpdaJcsRBFzr:HNObFb9HklwMJi7yfckJpRB9r","tlshash":"cba2e14b237e356eeab0f2385011426fdaac89728c0456f7514f891f84fbb424e085fb","first_seen":"2025-09-07T17:25:11.462318Z","last_seen":"2026-07-03T06:22:49.549589Z","times_seen":178,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_012.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.520Z","timestamp":1782880719520,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_012.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"e3fc-19efe3ba3f0\"\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ta2KURbUJncsUs8eZzA7er8wYtUvB%2B61GW9nRaC2K5NVCwLpvBkL1AS%2BDstpmcvERc9sSAfN8F6qvO4RnaBx6exb65v9O7uev5INX9jnsp7CAODRAv1W5M6uX0MqbIpg\"}]}\r\ncontent-length: 58364\r\ncf-ray: a142b8f10c6756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58364,"size_decoded":59058,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"742f428052c448f7b014809ec2b69316","sha1":"63b2820efb2c0efa9122e7db31f2d4e7071a11e8","sha256":"70d8abf5b93ffc8fb6fc8034896e467bb6b87da216af6189eb79f9757261773e","sha512":"9b276c3ebab9b05b79a04f042f71eed440f882ae631953dbc5e30ab78e8716c5771af3c7901ef0233bc823fde6c6822f01fa2977eb247bd793159a85a1317469","ssdeep":"1536:Ntd2ZLLUx9El0qlKIQUI9FSlhWc59yPz6zr0rAsYv:NKUsl3vI94rkHre","tlshash":"f043019af11858dc0d34e0b796c060dc9c637aaac04f3dad4b084aa4960df1cf9b2bd7","first_seen":"2026-07-01T04:27:05.866316Z","last_seen":"2026-07-01T04:39:09.934008Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_006.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.583Z","timestamp":1782880719583,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_006.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"aae4-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2VFGETQTt6tQ08M59O2LVmZ4lPwsKiExFiFsnox5rIXtYTqk7OW1eOHjQNCvhrmOQ%2B4AeIBZGXD%2Bhl5%2FJBkk%2BogXq%2FMFCbhuM6i1mN1F1S5FeJP3iePe1wnD1jCwM3Tn\"}]}\r\ncontent-length: 43748\r\ncf-ray: a142b8f16c8156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43748,"size_decoded":44451,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"60a09a88459ccfe864567af043f47fd7","sha1":"273f3b59f4f6cedc9e1da5f7115aa476615e3bcc","sha256":"cbd747a5222dfcf0446af2f16a7ccdd8d9fa4aa7d32a5b2837399f7a8837daaa","sha512":"7a10331cc0109d9b85f9c89e9340de419d04035caa399acb636f5e2814347c76b96dbeca89d8635dcff1e499009244c995b240665c46919ebc7e50c0be2e5273","ssdeep":"768:b0gbZDyrAQpYZfCYTHFx2wgHG7XO/4yieqNB+RMRwXw/rAj2StUs:ogb4r/YZBx2wgHYO/4yie+Bqy0th","tlshash":"0613f146cd1dd1cbf13a80b9bbed4d0079d510fd44c1e85788ecd86ec6988ac78b6269","first_seen":"2026-07-01T04:27:05.871834Z","last_seen":"2026-07-01T04:39:09.934665Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_000.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.284Z","timestamp":1782880719284,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_000.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"d567-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JZpe6tr0nfuOXMqw99J1BHIXPvV%2B4gXnsKaG5jBon3EqQ%2FU57ZLZdpAUN%2FqEoQdeZUBALk4YHvNoUSDa%2FvUm17MBh1gTaE2T0P1wrIDDnjk%2B0MN1GPr9SpH7rbUWQKyf\"}]}\r\ncontent-length: 54631\r\ncf-ray: a142b8ef8c5156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54631,"size_decoded":55334,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"ec52f5d5158ce8be269b6ca173d2b3d8","sha1":"1b10991ad0570abc80cc5ea51939e743d1f3e53e","sha256":"350748b6a57bc5751bf4761f3d4147bf45181f28cb460ed89e97deeb8c3bf7e6","sha512":"ad383341bc7dae269621c540799cba37bd46db81946dd49811ecdbcb7138ed9c830cda6c3327a823d108d6336301192ab75a8367ad447eead3a71ecbbc44feb0","ssdeep":"1536:bBrxl90fH4v4GK8Sa5v0Lrr7JKaDQqxIl8lU5WRJc74uG:ll0feDSl7JRMflolcEuG","tlshash":"613301fde4b1f55d08eacca60715e5d8235a34bc9b006eba4a2a0405dcc742eb3e467f","first_seen":"2026-07-01T04:27:05.843453Z","last_seen":"2026-07-01T04:39:09.93553Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_026.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.556Z","timestamp":1782880719556,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_026.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"fd15-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WiDmS3gCAAvgoimkpPMr57QMiItIeLyV9%2FqpffquY0e7Tgl5oVnD3aKfja4nVWxQ8DRwmkkwrc4hrOiVf3KaryXWx9hnUKDKpGAHk%2FDHZxITOesag8qDrlvalgFZ69zb\"}]}\r\ncontent-length: 64789\r\ncf-ray: a142b8f13c7656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":64789,"size_decoded":65486,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"9d7efa98dd80f5339d4bbc7807abb442","sha1":"517313488b36dd28928010cead8418daa1c122c8","sha256":"6eb504dbf6491ec190994b1ad02f2f75d8e5052b2bc9ca6d4c73c190c45d2f26","sha512":"6b1f808decb575e8e8d42070ab787c70c841499bf3b6d8a1978804b1f68b078b4473368b4917cc523e1c4066ade697c751a18acffda65016d71ecb2d237ca8d5","ssdeep":"768:dlI2sNQHEL2IINAvEvCKUwx6z7b15yOIneAvaQTbD+HGZ7ymI68xzipd93JG5h/:dlIr2dIJnKUwdeoTbDerr2p385h/","tlshash":"0c53029684d170e948346df02b3d81ea7eac7710432be6d177e69a8ff52933f8e61904","first_seen":"2026-07-01T04:27:05.797441Z","last_seen":"2026-07-01T04:39:09.936481Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_004.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.499Z","timestamp":1782880719499,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_004.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"dcd3-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rBdiVxKDXt2ETxJrdkYXEusfzfuBkTZJrqw9sCL6%2F%2BiZobymNs5ics1dZhABr2p6jqUSj1nxxkIKNf4oK2pIRw%2Fsty1dC9rK7VRpt4yAjEhB9XjSd2PJLEx6%2FmH43yZT\"}]}\r\ncontent-length: 56531\r\ncf-ray: a142b8f0ec5c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56531,"size_decoded":57232,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"64bf803add0c83f8cc48b4cd474a86e8","sha1":"1732fdb54aa4bd1ab53fe0aebc033236657fbdd3","sha256":"cf2732a034c8e03d37088bb00ef3cdf9fb46f4a55438c3e4f4eece1745f23fa1","sha512":"96bd0ad4dac5851c4dd2ae16e319703a3f0011988512474dc2256e46e2a3da80593079b9d5f9fb02b3f06c372a8b45431a8ec50e974978199c032f77dbfea452","ssdeep":"1536:nqktPZvvRlERbgekp6l9cMO/5cXjEVxdUhl96GA30EeE5h:nq0PHlcbxw6rcM1EVxihCGa/D","tlshash":"6043f1191130af151a2221fe4ef21f57e63b62aa9cfc9237de03965073d2c93e68b605","first_seen":"2026-07-01T04:27:05.803685Z","last_seen":"2026-07-01T04:39:09.937168Z","times_seen":2,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":93,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_027.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.630Z","timestamp":1782880719630,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_027.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"c53e-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u2SYsd2UCTfV%2FwFV1Qc1S48%2BcVmPi0ZZ3UHuVf%2Bxy0AmC9aVfQFbK5H1Ac0YmoeaPbyId1y0NDI1srrdV28jACAR%2Fyw7xjcaYla00oQ%2BrBsS5TilkSIdkkGcqBeFhc35\"}]}\r\ncontent-length: 50494\r\ncf-ray: a142b8f1bc9956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50494,"size_decoded":51197,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"2a7f6f4b816456b4e9d32b9509282bfd","sha1":"a84bf9e50a0784181956b26ad14c35c35f2c1445","sha256":"5c0c134dbcbaf75ad09f86c423cf6cd745f13d297602356af5acb593663172dd","sha512":"4e0c453ae49c89a1d230a6fc45348e06141c0d7d7f20684100835cc45ea56b617055e1b190d40b6ad8da375992b67d2fef51d8c7d1c32c4afde9f709114f9934","ssdeep":"1536:OZfUM6NufNlGZ+OhnmjKrzd/IX6YOccRh12:LM6NWNAIetMOccI","tlshash":"d233e0840a4ad5de2ed2843d73a586bddba4d05fc0a80186a3346c741d90e6eed4dfbf","first_seen":"2026-07-01T04:27:05.846448Z","last_seen":"2026-07-01T04:39:09.93804Z","times_seen":2,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/login","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-01T04:38:38.863Z","timestamp":1782880718863,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:38 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-encoding: zstd\r\npriority: u=0,i\r\nvary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Accept-Encoding\r\nx-nextjs-cache: HIT\r\nx-powered-by: Next.js\r\ncache-control: s-maxage=31536000, stale-while-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uLyN2dvLLl%2BbXORBnxq4QFmjhLTBSi9nbZpx2rhHBql8yHcyvQNPJYO7XgBE5ynaLlBplWc7aJ1pIgYHVQ1OmO7fpxKjQnecnyHL1uwi1%2Bjy2Wm7RlvOXTC2iO6eqoPD\"}]}\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a142b8ecec3756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]}],"data":{"size":16099,"size_decoded":4901,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9017)","md5":"ed31d07a371880b37df19c10af8557eb","sha1":"4f54bbb03bbb7ff64b82ad01a2aaf21f96cf5b18","sha256":"cb99486cd5d57018d4e07a58f45ea3254214480e163194d1627c0514482e3305","sha512":"0669f55430ab608c14b6e9914a90ff412998b359940687bfe1590e7be47115dcee85720fab6e541845cf259303aeee6fbad873050846db93f1ce435aaa82bd91","ssdeep":"384:IoXOU+C0OIvCVcY14brncccccXx8D6fR7:IoXOU+C0OI79bwx1R7","tlshash":"5c72a570ec06dc1768779a6421b91d39a099e72ad9538c5cb3dec3131fd7db62382e81","first_seen":"2026-07-01T04:27:05.832061Z","last_seen":"2026-07-01T04:39:09.938855Z","times_seen":2,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":75,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/b536a0f1.1249f719d932f90b.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.594Z","timestamp":1782880719594,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/b536a0f1.1249f719d932f90b.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"a707b-19f154b1cbb\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vhpkW9x1xS59V3Ya%2FXhOcFEQj9jYnZp6lrmkQl%2FDle6ByZ64MpwREedB5xp21KSemb58wEcBGiU3GQ8Akf5zs3%2FDxjk16bBdsQqQJADU%2Fz%2FTVrqzWEKBqjSu3E%2FGU0ea\"}]}\r\ncf-ray: a142b8f17c8756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":684155,"size_decoded":170622,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"9e8d1a34d70f4e7b723342d4f8881923","sha1":"a298a99d4ad29b7c42c98d5bff697adeb8ac2655","sha256":"6404d6a8cc44d9181cbb433fa67059a54f43e6ba4fb0df7927e7869432b6450e","sha512":"3930807c1d1dfb1c1b2b5c5de8d7b684ab4ef506cabad4434e251c1c23352a1a66aab490e6db1463556fa72d642df7255df294bbdb0fe62c4946bce6e5c76783","ssdeep":"12288:n9zr4NWWrJmF5SUzWexaCyEM2H+IlQcUcb/:cWWrJmF5SUzWexaCyEM2H+RcUcb/","tlshash":"1de44bf53271b0134b5b909754ba0443a329b4db380d857cba2ca4dbb4e498972fbfb5","first_seen":"2024-10-25T15:55:06.811839Z","last_seen":"2026-07-01T04:39:09.93953Z","times_seen":5,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/fd9d1056-6e8b9da6262156de.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.270Z","timestamp":1782880719270,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/fd9d1056-6e8b9da6262156de.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"2a322-19f154b1cba\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6pWpYScH0UP0vT08B3RsQV4aPE5O1B%2FFrMOP3xJmfczqPOez27avVNBas8W1yGw4iFM%2BqJXNTVFetV%2B3JEJwySmpU5CGcdP5iO9ufu%2BYHIq%2Fq%2BephTuzJEak9i8IqPPV\"}]}\r\ncf-ray: a142b8ef7c4d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":172834,"size_decoded":54523,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d70ea42503ecdf865cc5b50951e7a260","sha1":"d6024cc44a508c5e42bccc99aa6939490273b3a3","sha256":"b8bddf9481d859d648e1e050f8322eb3defe3dd3f9bd13f4c44dd6f2ecf5ab80","sha512":"c38885a712287d6c88b14f3a78df8b03c671a1e8fe71ec680edad591b056eabd5cc510e7cf2b565d94779bbb258ca49068d31adb94d343d59c653c57e77035ee","ssdeep":"1536:PVjExazug79h2U4kcNxakmBjt4oGZlibTR5ikxYhlUuRNka2wblHiN+wL8z9Ggum:3zug758kkEiXjOAprX2wd5WjguGOK","tlshash":"50f3f8e83995f6666eb30277009f1803737c262b280d4d60a211fd9eb5b845eb17bfd9","first_seen":"2025-01-18T11:47:06.649614Z","last_seen":"2026-07-03T17:33:04.056394Z","times_seen":3950,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_030.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.567Z","timestamp":1782880719567,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_030.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"103df-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BXWGG5QV%2FZoCPsDvcNhXIKEx7DHa%2Fo2bmNpi78Q5eg31vEmKC6%2BNKMouwkdlE%2B4m398kTqT8YzM89A1S%2Fu9mCjIALArWZ4D1D2%2FV4aHG55hx9ry62r3g4rHME5Y0SyiU\"}]}\r\ncontent-length: 66527\r\ncf-ray: a142b8f14c7a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66527,"size_decoded":67233,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"7cc99963d924b58a66b257f56f6df118","sha1":"539d36f813692f43bb448fa28c8180ddf9b4d0d3","sha256":"f2929055dd52bf4ad4a9dd1a9b2a4d752409972c7f2c3ca59c807ab350eb301e","sha512":"916225f2ee7fd6c0970f7bf80ffd081e216fbf575b63e79b2c3f9c1206438b5d2f45a0ce59cc577d976e8fb1c0ad8a28b83f50120836257e0055ed411e125527","ssdeep":"1536:aXvysj3KQR3sn4ik24kclBuhMVFgSGgT1bmreLGmCEij3ThWW:aXvysRc4iKQMXCgTZPLGJFv","tlshash":"6653026e290b5b5391a70c3af5492d5ed7beb1a392a351112bb1c6cf20548fe2973238","first_seen":"2026-07-01T04:27:05.876177Z","last_seen":"2026-07-01T04:39:09.941244Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_001.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.572Z","timestamp":1782880719572,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_001.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"ad62-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GNG8E6bLsYTozSqgIk1mbg%2BxCTpHkBUmH6m8jyjTrWv1vd84Ilqw376nEICX98dVOiRs%2BcrNsk%2BFsO3YMJWaJLUum0kOkGo2Pf6ARWWfxlnMKt1fWgvAenlrevj7%2BrsL\"}]}\r\ncontent-length: 44386\r\ncf-ray: a142b8f15c7c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44386,"size_decoded":45087,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"b9e2c6c5a73b5ef589fc5d8d062e03d7","sha1":"85878c62f9c39e73dfc9028fc532fcce0aae4d7e","sha256":"b56d9a41881ad638c175b9df596dc752c9a8bbbd966c172ad544272d99b11592","sha512":"033d13386d4c57d08e564814848bf766af70e44e61bbecf3870ac1c71b500c5213147754350d6ad66ac38a6d9add1c09f252801dca0139bc0b28c9a7b814051b","ssdeep":"768:1mgsbwM7HNL2F2AOWBZletu90S12MtcmpBQXVzUc4Q0h9lT6ph6U:1m+M7tk/BLl12/eBIt1g9T6OU","tlshash":"a313e1ae9d71cb022ed7e53753242f83067700a7e8d2689ee51a752c7d55ef68b00b23","first_seen":"2026-07-01T04:27:05.827829Z","last_seen":"2026-07-01T04:39:09.941995Z","times_seen":2,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_008.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.586Z","timestamp":1782880719586,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_008.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"ab23-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=irYLVFQ4FvPsbz6MoAPaHXKNPtF5NutDSDeBuUHpGg8v7rk4PYT06uZKxNyswM8G2VWIO9v1Qrzy8J5kl3mX8mr1XdaCZ34GLYrUtmIE0apZg8IacHbHJlkxQF%2B2m0sg\"}]}\r\ncontent-length: 43811\r\ncf-ray: a142b8f16c8356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43811,"size_decoded":44506,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"4e15da00fcfddc63d28534a9a5ca87a9","sha1":"73cb6cd324d96f0c589cc70701e803a138345eca","sha256":"3858d9f3c3b0ad9df59c935daabdde10a6500a0dfe5710a6b688b364e25316b7","sha512":"c44f98777a3718c7431a7fc7227f8db665ad7aff3da179a452f5b224df84b9763258a70db28f1b58f95ccf626d299025844617fcc5dfddc7d45ba24fa6c3baeb","ssdeep":"768:b/tDwU6yZ/B5LMQ17zcdeXZnTvoKMG1ZsehMo43ZVXxtRWSfBEYXzObKy9mC:5BhzcqDoKMG1Zbhl43nBW2BEszXy9x","tlshash":"d413f1143830f9885e8b513963413fbbb13b540f89d51a62e8954c8e5bd8f849e3fa6e","first_seen":"2026-07-01T04:27:05.877166Z","last_seen":"2026-07-01T04:39:09.942639Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/chunks/528.73ed2743b29a9385.js","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.611Z","timestamp":1782880719611,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/chunks/528.73ed2743b29a9385.js HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"17bd-19f154b1cbb\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4WXGSeqwZagJJp1iBWq79aOBj2qiW8anDUvuq9vOz6m6%2Ft5EnqG9DVsyfqFGyd3aI1hml5%2Fx4iLk%2BsFNsES0%2FHA%2FwWvMK4e3tpSF4FK%2FYl0s7aPOtfjcQ3N05TQrt0XC\"}]}\r\ncf-ray: a142b8f19c8a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6077,"size_decoded":3543,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (5899), with no line terminators","md5":"229fb8280aa5f6850c3d93ffe8a42a81","sha1":"59c3ab378d6d0f0fcf0e3936da99681bd0c78261","sha256":"c19dcdb20c3e3b64f79f9d86318440f4983f2d1f2afa67958cec910a5c42a5d6","sha512":"8293370d951c6e03828e6d3e4561db39edf4e331cc303b22ab42ea39bd594f906948a72e10f34824379a2d137689ef87a05047a15d844e82b2341ec39fbb7e06","ssdeep":"96:edLqKx2KhmbTTcojTUZfg//qNgMgShrZH9JNPgB+BxIJvuKW9p93:AqKtmLcoDLU/zPgnJ/q","tlshash":"a2c1e8a932ca7878bf93bb144abf0109623a32b01508c0743a2fdd965b5596dd371adf","first_seen":"2026-07-01T04:27:05.834601Z","last_seen":"2026-07-01T04:39:09.943172Z","times_seen":2,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_016.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.615Z","timestamp":1782880719615,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_016.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"b231-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EzXortRu3nrnUSne8WdBRf7NDqBaX3qfAnWDa3K6VL6Qkv3RfvxmshKk%2FkjKM2uiZK%2BqfTlu0zH2d48b2Y8g%2B4dh1%2BEWBjCc91xapnpYWMVQHmtTVuE5TTKuzhy6ztud\"}]}\r\ncontent-length: 45617\r\ncf-ray: a142b8f19c8e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":45617,"size_decoded":46318,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"4ab4e09d2e53ecc8bba90de5096666db","sha1":"7f0ed0bc1105e0b637e8c1b04d6aabdf87828020","sha256":"15c6498535dec7c1460e069c9f89b148227cf9ef48f2c632792584e073f20821","sha512":"7853d0d87fcfc25274c90f5afbaed470bb502803b1492483644f3a2cd090c840f1ff638b2ed77de3c216084e6703047b50c02c2ab7cda915a81402760f6dbc94","ssdeep":"768:nCKRBPdoAtR6cKdwW9LYYZPj875tLmDGEyeQVAJ433ZtEZKRFt:nCCPdrtRiwsz5j87ncGEyeQVAI3kC","tlshash":"432301a86b30da592c833237c15a4f87853761b7deea31aee1d6307e4c6acf66351403","first_seen":"2026-07-01T04:27:05.869159Z","last_seen":"2026-07-01T04:39:09.943748Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_024.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.553Z","timestamp":1782880719553,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_024.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"f842-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ru7SAEeOfBh5TGVlaiR6ZNatndzYm7E%2FfBva2PkpYDnlwT%2BqtSfo%2F7DIRtPzTEhh5w3TXCwATCxF%2Bh4RRRf5JCu%2FKQctXj%2F56OEhGQ4igUVBf%2FTt2RrSsnV6nv1zE2M6\"}]}\r\ncontent-length: 63554\r\ncf-ray: a142b8f13c7456a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":63554,"size_decoded":64261,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"4c4173abc86f48a7fdb34269220829f5","sha1":"c6f41042259908af594806ac63ffe1f9fe67aa61","sha256":"6457bccdca3b4d1abc84c62b4e933aaa4359c2e2e34d914b3302ee8c71421954","sha512":"b4d8de995959450d40a2c7413dbf11e3151da947a44e554b303131cb9c7dc9bf39d58b82eccc9ef3d67e5a13fed75421c1a7af11106f920493a1a786b837355e","ssdeep":"1536:KDGhcttj+mNyrcy0q7/xQRNyKNEo0dGjIGZI1KYfK+wFs:K3tt3NzyhxMtqRdGjIsiKYfRp","tlshash":"665302c54493e34136396fa9392a3cf978651ec8735841b124f8dbadefa05fd1a027e8","first_seen":"2026-07-01T04:27:05.840199Z","last_seen":"2026-07-01T04:39:09.94431Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_015.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.613Z","timestamp":1782880719613,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_015.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"ae65-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hDtwvwotxFH4l19wk81akfnE8uWahJpfIObVy7hzt0KrUyZykRFLqMK3oQm2v9BQFCkefWSP120Tq%2BMuBRu5u7E%2FSYzgHSnhVuA%2FGD6c9US3YvZD%2B%2BME0ar9pqVuoZPq\"}]}\r\ncontent-length: 44645\r\ncf-ray: a142b8f19c8d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44645,"size_decoded":45348,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"9b80e50fb0efe96548fb3a31e4214f47","sha1":"9a6e600d7fbc9e76a6e9faf1df0a4c4407390343","sha256":"653e6c23eaa70eebe8a64d4f47c3e3f01f6da006473e81af5527057c6fd3b360","sha512":"aa532deaa4af79ddc6f9a590927bbb1f53126db75be00da89c226acb200d0a2819f3e57345942dccebb4032605c117adaf2a8773d4bab1761520410ee6f35c07","ssdeep":"768:T6l4BgZLZxMZRRkXULZ+hyLfElikh40PR7rAZabIsjbsiduqO10Z4grBnAO7f33d:TYlZLTXK+ZLAZax5ZmUrlAO7f3trFl","tlshash":"0b13e1adc6f0df590ceb437840275f9ba78fa42086e5b0b5e228491e6d88c7ce5472dd","first_seen":"2026-07-01T04:27:05.867211Z","last_seen":"2026-07-01T04:39:09.944826Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/media/427e4a37d3642943-s.p.woff2","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.254Z","timestamp":1782880719254,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/media/427e4a37d3642943-s.p.woff2 HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://evil-corp.app/login\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: font/woff2\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"52dc-19f154b1cb8\"\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JvsYE2ghov4M5V5AeqsGDEPRie8c%2Bo23Zhp%2FcK4ZvKubh%2FjPlPi8%2BtuxVmvxHTSHG2q4Ok4YukZZylK10RRuXKj%2BcDmMbXmgsxhdq1UdPDQ6tTO%2FsqiUMfXKOtywmn1K\"}]}\r\ncontent-length: 21212\r\ncf-ray: a142b8ef5c4656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21212,"size_decoded":21941,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21212, version 1.0","md5":"3fb54ef45e30f4206ba3326ebcbce9ef","sha1":"d087721d019c5c622305750607024aaaba2bff08","sha256":"d3dcdccdaba31643defe2317942155d4af3ee03951d058adbe8bc02b13e61b0a","sha512":"55cffc29b71f12e5dfb76f496d1e08f3e2ba8e9068fdbc7aad7867585f86e62299c22c0a6e83cc7cc937c70b73541b90da822eda6007f7a6d5695b08dbf38a24","ssdeep":"384:aK3m1rx16YXzXZtwEAWDpKZS6mP/jmmirsOfJkH0b+ubWeLyxz2cL:aK8x1X/WWDpOn6/4rsEdSubJLyAcL","tlshash":"0c92e148c88bca795e748374b6d69d97fabc1ffc620597b0a4251707e83a115525f330","first_seen":"2024-12-30T03:36:45.893767Z","last_seen":"2026-07-02T21:53:55.925406Z","times_seen":205,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_020.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.621Z","timestamp":1782880719621,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_020.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"b6fd-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sPqX%2F12Ec%2Fg3WYc7LNoCVXTdT9OuvI9Jm%2FtR%2FiqCpMXTdm6A%2Fs%2B7sUewBsU0qvxt7ADBhU1pl%2FZTmvUXeHuGBPHbA34Crud0VvwILkv%2F1YHMIbPqZ4Q0eo%2FzjIz%2FbzT0\"}]}\r\ncontent-length: 46845\r\ncf-ray: a142b8f1ac9356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":46845,"size_decoded":47558,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"8adde7db204db9c527c400c4edfa323c","sha1":"90d2ffc0c1e4ee1b1c07002e509ced67a908eb3f","sha256":"b5884dbef334b20bc0bf43ad0fa70596e4445810a6e83d3b30b8b0812b407d71","sha512":"0e9cb34b904bcee77525d7f29bc404b93f4d35070f5f270bcd2cc464878f6899c8d88bcdecb0ca0208fe4f5ce6c4f0366ce8ac3452d566c12b3f5c05a76738f2","ssdeep":"768:7tU6eLXmOGFARtR4SEDHmCqK1VRVpryE1jP1CAkXp4KkLxNRpwUst2PszSP49LcR:7+o2L2SEKqPWCUCj/R+OsOwLcfwQB","tlshash":"2a23f11cf5f0a7a9bce82d331dba891053657307ba088876e62175195fd27bd4384b8f","first_seen":"2026-07-01T04:27:05.873499Z","last_seen":"2026-07-01T04:39:09.945929Z","times_seen":2,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_021.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.623Z","timestamp":1782880719623,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_021.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"ba27-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SMEpT2EIVUlDaXPh0SVFFJEiEoJY%2FIYSSLBe4jKxOUllTIQ2l1QPm4WeWDzMUrKnlbeA0Zz4vLwOUTna%2BRe9eI3idMxxN%2BhcNcau%2BnsqSVRQEIUnPYgWt%2ByzHa82io7T\"}]}\r\ncontent-length: 47655\r\ncf-ray: a142b8f1ac9256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47655,"size_decoded":48358,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"44d9b1e00c61f3179aceb0106d9ee67c","sha1":"e630071394fd1741851d0280ccf6857fa79995b5","sha256":"8de0b03843b877dd43a1a487c3e316340ed0c7c3016d8f4c8b03e336f6f3031f","sha512":"a639dc59963f82bbd4ca8fbd88724034f84fc701531e88914147ebf69d4abe1c233cf47f6dfb9701cf9dc66b3e5c110b92136cba1d0968033b463fc5991dddc5","ssdeep":"768:/mO9+95w1VB+06TQ0NXz2WRidghqpVI/9o6mkv6yPOVAS2RB5lEmEDj9bVi8RgP/:+CrAQ0NXyL7i/9oXkvvPOVj2Rqvj9I8m","tlshash":"1c23ce731b795e4a305c46fb0eab5c63a97786c39e84626dbb5bf098e1542f417000df","first_seen":"2026-07-01T04:27:05.805411Z","last_seen":"2026-07-01T04:39:09.946415Z","times_seen":2,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":91,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/css/354c5821fd3dda54.css","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.265Z","timestamp":1782880719265,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/css/354c5821fd3dda54.css HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"8cfe-19f154b1cbb\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aHO4vRgwfG7Q7si%2FVapOJBluVp6BAx%2FSYtpXNJrZjWClDjUVdWxANGpqXJ0b1wyNbCfuHRMosqVndzgpfK9zX3q%2Bbj3MJNtRtS3GY%2B31sZwfNte6%2BY4zqYlQhfI5HQRD\"}]}\r\ncf-ray: a142b8ef6c4b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36094,"size_decoded":8846,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (32330)","md5":"5ccce7758b406c48992e9bc29efcc822","sha1":"8f941979cfd539a9e2aaa3c177fb643c7c7e3fa6","sha256":"f4e11f0592270c9b75aea00ce7eeb1295b6e898310d1fad795fc0aad127e6085","sha512":"dd9d49cae1cb56a3032df14e41d1ebffd320fed172f5160625403efc472c9697f7f9e58526908527d565847a70b8b4216ae5848d646fcb8c6c40cc83a8c2738b","ssdeep":"768:rTUHLRjleLChVYfOloaXpi0Ulxr7tHxZ2Ed:EHLRjleLChVYfOlVUP","tlshash":"e0f2852da749083b3c1380f7e594ef9ca117a6c5ff25a6ebfc4216018bd16e72da2744","first_seen":"2026-07-01T04:27:05.793385Z","last_seen":"2026-07-01T04:39:09.946981Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_029.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.564Z","timestamp":1782880719564,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_029.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:02 GMT\r\netag: W/\"10278-19efe3ba3f0\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X1FrV%2Fy8f%2FgsWQ3Phk3ntZHYQWSSLIBshrZQUWIo0XGbV%2FPr%2FKxcBzA7fAmp4RVQVg0KquHnFm0eV%2FvK6W%2BZt7GCaaZAJorz3%2BYe9mkIK7rp4OoZd%2FQBCDTuz%2FRov4RL\"}]}\r\ncontent-length: 66168\r\ncf-ray: a142b8f14c7956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66168,"size_decoded":66880,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"eb829210a7b266394ee14385f87b4bb3","sha1":"c1b6e0fda259a7b30c4b128b508f21baaf562578","sha256":"0de6392eb57df56075a209084c939c75ced04fb93af39fc3f768e45a79a51051","sha512":"22e236218daa5f0bc9e09163005cef051b23480a89c8d37b376468b68ccfa1ae8cb0c6fa6dde15f917c90a0f0a4c8bd39a80466001cbf704f5f2c39bb6d97c57","ssdeep":"1536:M8Oxycwzo1wUsHh37jvKTIE4v2NSt3DUMSyPplmx/KXWSN0jz6ISN:M8OEcaBnELNStA5Klmxu0/tSN","tlshash":"f453f182e42ddec3da8a21d590d604decb5effc60ac39ede321cb49e25a796dc213511","first_seen":"2026-07-01T04:27:05.7905Z","last_seen":"2026-07-01T04:39:09.947615Z","times_seen":2,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_007.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.585Z","timestamp":1782880719585,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_007.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"acc8-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tsXHZL03WLAHflfQFW2cvT4dHRNkthE3pi2xl80DGLaSir6UQVTlPCLsOTDlbBpRc76cDbSDcmK4O%2FIuBW5l0Mh2ejczIMfxRq02r%2F0rX%2BJZchoMqTWHUPbHiBQTsLZz\"}]}\r\ncontent-length: 44232\r\ncf-ray: a142b8f16c8256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44232,"size_decoded":44931,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"5c00c27bb7e31fe6ea73921c085f8899","sha1":"944a5e8d09ab62cbb36115e353c6e3f2a227805b","sha256":"43c247062e4368ec3974bd8005d06ceb77d2d9f78efb7a3a44984d79a03c856d","sha512":"8751569777b67ff1e1cdf54d3582010373fc950fcf6e5d6deba46852c4dc37ffc7a5ddddc337d4753f5b3c1d1843fc3925a1e0636bd818dc34b21b2ca8e4ecd4","ssdeep":"768:PHBIjVFpCjc0NsGYSrVAiBcWsB4DLCF8jDVHQW8aHGjMJA7eVNhsDj3h+yJPZ24:JIjL0Nsmc0DLCFAaWFHqSVjch1Pk4","tlshash":"0f13e1e058b5cfc33d1ba93a9cd52faf28e309e9d2f22401f0e918ac167dd2d954946d","first_seen":"2026-07-01T04:27:05.824706Z","last_seen":"2026-07-01T04:39:09.948123Z","times_seen":2,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_009.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.588Z","timestamp":1782880719588,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_009.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"ad20-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f2TlHciQxMEPTROL2XvLmOTtzxmvCVmqImOlpMumrttrbiqdvej7rNWw294rPePL5uGA5benB25vmov%2FfMp9C%2FKUaDyHvuV6pI6eaIr%2Bc1ybEAViMJ0TOHpcaMNnOmfr\"}]}\r\ncontent-length: 44320\r\ncf-ray: a142b8f17c8456a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44320,"size_decoded":45019,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"0e5221ebf1e6d197bb369dc9cf87525d","sha1":"dc9adec51ab8056d6d1d3658fe214a4772da5032","sha256":"55bc9b4749959a90a338ac3b1230ca527fab50e85875db79307a222011137681","sha512":"4ea08376e9e08b088004cf68c360bc68528c8c735990049bd8bccdb224eb4e5c35975c8d8e0e2377a7a4a678aba24fab1d058b16af2b71239a3ae21a8efa5377","ssdeep":"768:ND/RQu4OjUP1IBwXH0bd9tSVGelv8I9oqkHRd8OXfXR5yrzJNvvCEXnMJi9CNTB4:tJQuvNBG0bd9tS82T3kHRDffqjvCqn99","tlshash":"9c13f12a2e30dc40cca7b5bc8b66bfa33687446fc7fda0b5d1a6239c7616d1018d61c9","first_seen":"2026-07-01T04:27:05.868156Z","last_seen":"2026-07-01T04:39:09.948588Z","times_seen":2,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":88,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/_next/static/media/4473ecc91f70f139-s.p.woff","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.256Z","timestamp":1782880719256,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /_next/static/media/4473ecc91f70f139-s.p.woff HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://evil-corp.app/login\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: font/woff\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Mon, 29 Jun 2026 21:31:11 GMT\r\netag: W/\"102dc-19f154b1cb8\"\r\nage: 731\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PBxtRYmJUZJd3TpOhIAAhDNb555433s39pQU%2FihjlDKgYNj6humNeNM83YgeVThsHn4nRRsBuAxVlE8UI2vvLebi%2BMi%2FWACLpdSWP2CrhUs%2BOnkx%2F2h%2Bz5wSDpHLrGXa\"}]}\r\ncontent-length: 66268\r\ncf-ray: a142b8ef5c4756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66268,"size_decoded":66997,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 66268, version 0.0","md5":"78e6fc13ea317b55ab0bd6dc4849c110","sha1":"d06c767b3837999a8b98426e4eb16ca0a8080880","sha256":"296fafafd41304f7c992079054b8af914dbbd865f32de97c66d0f613b55755d6","sha512":"1ac8ebcedb1139e433a203d15b95c6ad3039f9454e891b960c41a77a5340a7223a6a2222171f038b88f58a21e15a7a5738d62a7a2a6183a06d76f1db7271f60e","ssdeep":"1536:ZhNKBFjd7ZKQN1MqewTQiqquIusnCF/LThNIq8J5W2XgZZB4aKq5ntF:J2jd7hZL0iq7BsnCF/s/XgZZBTfH","tlshash":"1f5301d48e8a8d202093bd46a4aaeb86823cf4575b34f9726776eb4d67044f42cbcd31","first_seen":"2024-10-03T01:19:04Z","last_seen":"2026-07-03T20:19:15.477538Z","times_seen":1803,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_010.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.590Z","timestamp":1782880719590,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_010.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"af7f-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4n3RJHFdb1rJp4LQr47PoOn0Q13JP4mHjhy99jh8iRtYDraOxtskxBjt4JOgmSszEXCBg3%2BDooDausdV%2FNsRJEOiFCjqyfPkiwWrfuIBn86SWdghmsKUOZjH%2Fdsg9doP\"}]}\r\ncontent-length: 44927\r\ncf-ray: a142b8f17c8556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44927,"size_decoded":45626,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"28398a2ffccd807e1b5135dfa92fe237","sha1":"bee88dee6da01853f644de47eee64c4cdb701559","sha256":"dda62121c5e3fa9970f3870e8d143f2e2b5a38f61671d24c804c50c3a871fae8","sha512":"9b70c4d882a95d2f97f8f85806cbd2f469d2581eb3359b648c76c6c120ac111a504fbff303ccbf1182ed6a7756341b7594a575e4b9bc442188216d4585a96e04","ssdeep":"768:FcYVcZbkI+oxfPj6/tlxceXdmYPxxFgOKtcuQ+VUZnNPwDmSlliqN7mB/NlpMc:ucc4odPj6bdzPxkYuD8nR3qNSV76c","tlshash":"8d13f0516e79d2a09f17cc758eac8f03d20f72608bed44b1e5a2847deee4de42ad0706","first_seen":"2026-07-01T04:27:05.872734Z","last_seen":"2026-07-01T04:39:09.949598Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_011.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.592Z","timestamp":1782880719592,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_011.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"ae0b-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tZkxCQ4EsI2oB9%2Bwz10inT4U0dFB4F8OrcEQQ9svQ3w0pSqpHQT7GojVHYImpeJXpIlGW2R4O%2BKzOHn%2F0CII6cOWBBsa%2BvTrV0yCeY%2FcX9KTCJwgcNXip0BNRK7MHJtN\"}]}\r\ncontent-length: 44555\r\ncf-ray: a142b8f17c8656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44555,"size_decoded":45258,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"a8e7d1e12964b82d78ab511d5a4678e5","sha1":"420c795953fdf8a9b86845f4c7b74097fbfe7aa8","sha256":"6a71aaeeb4ab1b42d78f443df746300edecbc9c1d974d530242173e8fef8a1b2","sha512":"94064c1c1c563c79e5b1521f98724cebc5bec377a75b4ae1c4bae8fbe9d57ecfef1cb64d2d480223e8e564fbba350195c991664b0253d9cb2ddbb44d45fd5737","ssdeep":"768:BC+CTAiXFNXQItWKeKWJLKjKfB2yXJTc+8EGoBc059:I+PuAeel5x2I16EDBc0z","tlshash":"dd13f1886d38f98f3cb72179d3544f520a836a061cdbc440e59182ddc8caef1c9aa96f","first_seen":"2026-07-01T04:27:05.857906Z","last_seen":"2026-07-01T04:39:09.950064Z","times_seen":2,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_000.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.287Z","timestamp":1782880719287,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_000.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:50 GMT\r\netag: W/\"a790-19efe307890\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2C6NeSX14jfqHP2GKOXBDWwG5j7aYzwYjc%2B3RRyxcYUD6U%2BctHQhCBzjYCRkxnIDGXS%2BqXRpF616t1hQQRzYmKoW2IwYnV1ZCGW5vjaKbMLmAjhGPkQ31h1wXF7yL718\"}]}\r\ncontent-length: 42896\r\ncf-ray: a142b8ef8c5256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42896,"size_decoded":43595,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"e36fc9355a5304febd986a1172309813","sha1":"1f99313319e2793338259ebb67a3c5274a8f0e2a","sha256":"1ed5c11968d5899176cd92a90d2f3abd659e148244156468b3cb860bbc032a58","sha512":"c50423c2e651d16658e3eb85acc0dac41f5f75416d6090d60443d9432e4a606baa99c2e1943914bbba88a062e63de7b76470a8485995cacb0bdd09c4eaa80131","ssdeep":"768:4ZDkLjK+JcwEx5h1QbUGmmjsA31+wBb6ljy+UwVxYPiea6STzAVohIW6LCvs:eDUK+Z4Hmbzts4BGcaD/pTcGx6Lws","tlshash":"f513f15ef0fc2634edfc95b64a0db8181760fd5e3199456ac0baf8730e4a6fd81860ad","first_seen":"2026-07-01T04:27:05.796154Z","last_seen":"2026-07-01T04:39:09.950998Z","times_seen":2,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":95,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/lefthand-frames/f_007.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.507Z","timestamp":1782880719507,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /lefthand-frames/f_007.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 10:03:00 GMT\r\netag: W/\"e9c1-19efe3b9c20\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=flmofiIs5B2JKGKZ4KGMj70Tkq7PSgci1MqTZLSE4BdOCMBc2jwVdPO6jpIwJQAWJ8pcJRMU%2Fw8kn%2BeSfbn4f3DIK7IU2Z11SfoE8IayUjvNrYLxG%2F5sWcGyXggIWrHZ\"}]}\r\ncontent-length: 59841\r\ncf-ray: a142b8f0ec6156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":59841,"size_decoded":60540,"mime_type":"image/png","magic":"PNG image data, 424 x 568, 8-bit/color RGBA, non-interlaced","md5":"c6d94a251be59b9ffd29146586823d3f","sha1":"8e894cfbdaed134b7a05766f9f590dbc4eaa9e77","sha256":"d0fcd78400ac257cec60d46ddd0e1aafae256315357bc8128c36906243cab6b5","sha512":"d0f512efe199aeee6a82ec61573570b611d2abc68169126446552d822bd5d63da31fc1058d68c25919b394865d23ae49a6e953760f284fb57343a36aa7ba53bd","ssdeep":"1536:Xx6JG6cWipDXWgKy36eSVMq3phRP7s1kCR94BvpBB9:X0JG6cNrWgKI6eS2e2xRiBvpBv","tlshash":"804302b4f9384e9b4ca4447fbee1644690d4021ad50cb17edd92fef276829b6f3402d6","first_seen":"2026-07-01T04:27:05.802778Z","last_seen":"2026-07-01T04:39:09.951557Z","times_seen":2,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"evil-corp.app/righthand-frames/f_030.png","fqdn":"evil-corp.app","domain":"evil-corp.app","tld":"app"},"ip":{"addr":"172.67.221.32","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://evil-corp.app/login","date":"2026-07-01T04:38:39.635Z","timestamp":1782880719635,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"evil-corp.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 27 Jun 2026 21:12:16 GMT","end":"Fri, 25 Sep 2026 22:09:58 GMT"},"fingerprint":{"sha1":"62:71:AC:45:39:DF:4A:A6:21:F3:BF:76:07:6E:84:53:A7:B3:B9:EF","sha256":"A5:1C:B4:08:A4:C3:51:67:94:FB:95:6E:68:A9:16:95:52:87:98:03:D0:2A:83:0E:80:0A:67:62:90:9C:1E:2D"}}},"request":{"raw":"GET /righthand-frames/f_030.png HTTP/1.1\r\nHost: evil-corp.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://evil-corp.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Wed, 01 Jul 2026 04:38:39 GMT\r\ncontent-type: image/png\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\nlast-modified: Thu, 25 Jun 2026 09:50:52 GMT\r\netag: W/\"c911-19efe308060\"\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QeY0otXj8WkcKvK7m%2BCecCan%2B1eMeNmNxpXjtANbeorzsXw3LzYOOOosIeeullXrbEUuJRogiboVxR%2Bedt%2Fb72pQlvhpZ%2BRDKhwc4oHUAVO%2BJbsaGvcTNXU7Xz0YPA9M\"}]}\r\ncontent-length: 51473\r\ncf-ray: a142b8f1bc9c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51473,"size_decoded":52178,"mime_type":"image/png","magic":"PNG image data, 404 x 540, 8-bit/color RGBA, non-interlaced","md5":"751aa68ef6f1a2a49a9cbc2a9e1f8d32","sha1":"2124e7a95cf51c2f594235007de513d2d9b6668b","sha256":"30af596444c1ab710886d593cb1e28d980197eafbdbabaa8606fafdf79eb9238","sha512":"f0cf5a79c79f505649d149210eaaa8e7de99a8a171aceb9eeb041d592a31464d893bdd6d6a08855f38aacf696e1382cbfb7e8f3029a8203d81bd882ee76d9177","ssdeep":"1536:Y6aeyA46Rn1t4yaJL64vEoU3HwMDpDuNo2:Y6apAPRnMRJXS3Hw8Qd","tlshash":"3633f02d6691c36c4dd695acbb619dbdab82d067c2416a214334ad24be02d0dccbed3f","first_seen":"2026-07-01T04:27:05.851788Z","last_seen":"2026-07-01T04:39:09.952155Z","times_seen":2,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}