{"report_id":"56cfde07-ddcf-4239-8750-a8bc9d918459","version":6,"status":"done","tags":[],"date":"2025-12-17T05:39:59Z","url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"title":"RuTOR - Самый большой форум в СНГ","dom":{"size":53197,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (12037)","md5":"bf8a9f58d0ca30ae5e59fad4e4a9f54a","sha1":"393a8e7200db83efacc894f4b3024a0eb47dfb99","sha256":"cddc1df55b6004bb9a065fabff42104736326138677b59fef1e25fab56447475","sha512":"969245f226c1e9ea273ca35e301532baabdcb333d084d7ba031abe5a8daa0084b320ecf8dbba9e6db40e2d06b6b50557796050161b5e1ae989e938f9258bba9d","ssdeep":"1536:fwVO9aF/rAkaMNCOGOxODOxOhOTOYOTOMOwBKO/OyOrOPOoglOKOaODOkOvOWOLf:fwTaAC/wEyiedyN7BKQFYixgld/mNAtA","tlshash":"783375b944e1783e62038ac0a0b17b6ebb57d607dd13855173ec1be96fc1cd9ae021e9","dom_hash":"domhash4909c50013288355a04509c9cfa5019d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-21T05:39:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-12-17T05:39:37Z","timestamp":1765949977,"ip_dst":{"addr":"172.18.0.13","port":35238,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"95.179.141.146","port":443,"asn":20473,"as":"AS-VULTR","country":"The Netherlands","country_code":"NL"},"severity":"medium","alert":"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)","source":"{\"timestamp\":\"2025-12-17T05:39:37.019221+0000\",\"flow_id\":1705663618660705,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"95.179.141.146\",\"src_port\":443,\"dest_ip\":\"172.18.0.13\",\"dest_port\":35238,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2025194,\"rev\":3,\"signature\":\"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Medium\"],\"created_at\":[\"2018_01_09\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"updated_at\":[\"2020_09_16\"]}},\"tls\":{\"subject\":\"CN=sorrybizzy.xyz\",\"issuerdn\":\"C=US, O=Let's Encrypt, CN=E7\",\"serial\":\"06:4F:D9:A2:4F:CE:BB:1A:DB:70:85:4B:B9:43:B6:60:D1:30\",\"fingerprint\":\"ae:2a:27:28:5a:05:36:8b:f9:05:ab:fd:1e:7b:be:0b:fd:f3:45:17\",\"sni\":\"sorrybizzy.xyz\",\"version\":\"TLS 1.2\",\"notbefore\":\"2025-11-26T11:46:32\",\"notafter\":\"2026-02-24T11:46:31\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"fe0146829eef1917ba6c2dd4f5c08905\",\"string\":\"771,49196,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":6,\"pkts_toclient\":5,\"bytes_toserver\":1014,\"bytes_toclient\":2676,\"start\":\"2025-12-17T05:39:36.964961+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"rutorforum24x7.to","ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":6635228,"first_seen":"No data","last_seen":"No data","alert_count":11,"request_count":11,"received_data":1146131,"sent_data":5706,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"UIKit","description":"UIKit is the framework used for developing iOS applications.","website":"https://getuikit.com","common_platform_enumeration":"","icon":"UIKit.svg","categories":["UI frameworks"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2025-12-14T22:17:32.87103Z","alert_count":0,"request_count":2,"received_data":744611,"sent_data":893,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"sorrybizzy.xyz","ip":{"addr":"95.179.141.146","port":443,"asn":20473,"as":"AS-VULTR","country":"The Netherlands","country_code":"NL"},"domain_registered":"2025-03-29","domain_rank":0,"first_seen":"2025-09-12T08:24:53.534026Z","last_seen":"2025-10-12T20:02:11.758164Z","alert_count":0,"request_count":1,"received_data":4712,"sent_data":716,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"plausible.io","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2018-12-30","domain_rank":8565,"first_seen":"2019-02-01T08:53:03Z","last_seen":"2025-12-15T03:57:31.851766Z","alert_count":0,"request_count":2,"received_data":4405,"sent_data":905,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"image.limo","ip":{"addr":"172.67.221.202","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-02-17","domain_rank":1858281,"first_seen":"2023-02-18T18:13:39Z","last_seen":"2025-09-12T08:24:53.938611Z","alert_count":0,"request_count":1,"received_data":2976,"sent_data":463,"comment":"","tags":null,"fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rutorforum24x7.to/js/app.js","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e4d52becb7e39dd075a8bc6da9d113c8","sha1":"055e0aa66aef9f8a49109b56d218630c63649097","sha256":"5e81b1162363347379f396828a98086ff36c87125527632d27e7f59390280940","sha512":"ed4b29e94fa871c39ae50e7062040d25c0706343f26ee4b2a77ecd3cfa04198eea2fae10b331ea97df3c84a3cda5e80d4dac5d8f617ffff0c06a3ad749dc7131","ssdeep":"6144:qARixCIKcxACFaFImJaNp3g7q00F0gRMG2ey5t+imubhIWg:/wICFaFIqaN5QhLt+im6y","tlshash":"cb94189db2d2b07547a762b0402f150bf23b6998744a80d8f639e8d57d7884ea13bf7c","size":448764,"data":"","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.46126Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtm.js?id=GTM-52LD25XR","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"9315fe3fa1fe791eddd4a22edb53d56f","sha1":"6f3f866a7a2f46ee16b3e6547a7c319d10501f95","sha256":"205f69ae8ddfc21da7d81144449a00d2ceaba7cd676079e7a17751c5fa28d3d0","sha512":"4bf26823694caf3e8adee41b59a042ffdca603da992a3052aa9860f68bfb5fa16d3441d5a235c129a6a3410c4436b1cd7874dc61a2a8500ebd17f1a44c5134b2","ssdeep":"6144:QIeJq2bulKYv9VHDmHYmyBFz0nsywWCxRnc:BSbu7llAns3WCxO","tlshash":"956418c9b3d6702683a3a474503f118ba17b79d2e84cc895f186dcd42e74aaa4237f7d","size":309807,"data":"","first_seen":"2025-12-17T05:40:06.480454Z","last_seen":"2025-12-17T05:40:06.480454Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"4a3131d117109761c92c12a462d6cfa4","sha1":"b251901a85b8f92e6f5c734a9fc6d927ebcde24c","sha256":"2da8b278a1d0162070d9be290a543ce57d92f4e480073587a2c31076b0adc837","sha512":"61e48975ade4550b07e465751401cec295825ca0d9ba8f0158dd3c6c9fb33907f17f5113311526ca706f15a4f42d5c8ebd9aec8468ffcdc405f2018161790414","ssdeep":"","tlshash":"d741b27f1ceeb779cd0a9682c45e78b4b84f28fbd52161d5a5654c1458ec2741b0f02d","size":2297,"data":"","first_seen":"2025-12-17T05:40:06.508554Z","last_seen":"2025-12-17T05:40:06.508554Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"b6ac9bfe3545a874ea9156ca9b627e42","sha1":"f8f84b87f832613976de38fd98f5ad645e39e55b","sha256":"93550b53f2d5ed313a9d1334c53ddda59e07836697ecbdd3ccaab3e5c225458a","sha512":"a48d02537ab92b57a34d11b70bfacad38b7256e221f9064d2beca1daedec5b3ab37ee638fd3c0623394ae628c0c47266ebe94869264978b2a0f13ac9c2036872","ssdeep":"","tlshash":"f4f0a03340efb635cd0a2804005a3c96780b68aab804969992bcc85de2a13b50f0f86d","size":443,"data":"","first_seen":"2024-08-20T16:09:46.127589Z","last_seen":"2025-12-17T05:40:06.510798Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"5e98b364c43e1b01242d039765987e8e","sha1":"8f40f141718b22a150f48273f4399d9be4096a28","sha256":"71072b40a2a571a48f30869fbade81cefca15e4b47581668ee7f333d244bbb5e","sha512":"9636d79a6187411783126e0b6b9316c99b032e37315eee9376735a10534ca418fe4f60e0cff804cb25d89f55e0f98a73a3a628087b546981e1b8fe0004998f72","ssdeep":"","tlshash":"28e07d4a04edeb758d42a440101e25b4d00f19fb823594c4767c8c5523490600f6855c","size":312,"data":"","first_seen":"2024-08-20T16:09:46.124404Z","last_seen":"2025-12-17T05:40:06.51298Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"c9db6cbadf145727a570b6f6874f1c4f","sha1":"298cba0e504b20b3ad09a603d69a4853e7dd2647","sha256":"3cd180e008087985cf9a5241d6b8809881bca1f7873d0ef4e47165f2238eccef","sha512":"3d1383225a75f30cae07da374a9b872321450dca63eedde0c6af3e04d47e284983bab0a72b1b7cdcfbba1e37e6a3f9e4a97052a5207e8c8480e8f98244ccc3be","ssdeep":"","tlshash":"0ee07d4901aee7768d425100041e26b4c00f18ff82365484797c8c5523480504b2851c","size":307,"data":"","first_seen":"2025-12-17T05:40:06.514802Z","last_seen":"2025-12-17T05:40:06.514802Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"9928929b6fbb93ab98413327c358c00f","sha1":"854cc398d1b87e1b7f26600da6aa632ebfac26b8","sha256":"5a666fdf3590961df0bd124dba69e3522434cb178cfa10b1e494372fb6e49906","sha512":"68da316416cb1c010c739f3fac7470fe95d611a2f67bbc5a77dd70cda39a354188fea27f1181ec7768c44ccf666598437e99869a36087df7c32bc0d92b995ac0","ssdeep":"","tlshash":"79a0124610da2c1446931131b5355d05240800f054409c01b1cccc461896030971027d","size":86,"data":"","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.517041Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6783d3434e2cd0b7e2e24abe0857890b","sha1":"1a1726127e18fb8422a28b2edd2d55e22d4de840","sha256":"f15bff22791d2c719c5ed6abdb95536f0b4b92b0fbb10948d90838b240c48666","sha512":"ff23cd3aa28b463cf90ed928ed261f7681198b7e6573223c18bf4eed217fb600143a31c2bf2eb92df76863c8226470ce7ddeb3cf93e23262992f68f7d6a504c8","ssdeep":"","tlshash":"1ee0a3e92c95813955b815a1a373ca14745109493c4afde1d18d88c16d35fe8188e64c","size":433,"data":"","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.51949Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-S79VD4YDXT\u0026cx=c\u0026gtm=4e5ca1h1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a86e8be7d062ffcf84fa98b56609d052","sha1":"0fcd066e8bed1ba6743996e57c7665f53468b80c","sha256":"7336d7a6944b443fb8d5efbee6c8957bbef020693e5e747f20878c4fc9c3d8e2","sha512":"2b2efb2b301854520bc9e626bb1fe054fd515001881464f416b7f593ed958fb4726889b034e68755aefbd6cdff3babca6f0ff9299e5165bd971f661708d6b034","ssdeep":"6144:3LIe7ma2bulKY/1u99xHDmHYmyBFzvnsyRO6jJWoNPad4FpC1xY:cC8bu7/1mbrnsy39WbMpb","tlshash":"a4941ace73c674269396e078503f118ba57b29e2b45cc896f189cce42d74a9a4237f7c","size":433554,"data":"","first_seen":"2025-12-17T05:40:06.467781Z","last_seen":"2025-12-17T05:40:06.467781Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"fb3637f71449a25d483a28860f162005","sha1":"39b18327c7ed199b06b749e751fe66938ccc0cee","sha256":"71308fb2981e2544f2a8df2c6a56fce93047de96b603f33b26b588b29c0790f5","sha512":"e503b2468a128b874bdaa7a76a384f78e58dd08bf0593677244f598eec97eb865fa509672af1c35b0bf087082b313ab73fedb52e4165f2f6c4853bcc9a769b08","ssdeep":"","tlshash":"6041cffe04fef779dd06a742c02e76b4e40f48e7c93650c6aaf44c9484986a42f1e16d","size":2079,"data":"","first_seen":"2025-12-17T05:40:06.52121Z","last_seen":"2025-12-17T05:40:06.52121Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"de30996890870a03a0a4b2c4cf618c73","sha1":"cc7d66279041174455cef166d967d03d7c436da2","sha256":"46d93360dd7392b7ee809d0961db793427a8cd4f7ba73ce397da6052c51baf6b","sha512":"9842952e4aeae685475a6e4d2e027a28129e801f8eede095220b23e4e2d92a7d8397bd166b37bc7862c0aac869c5dd507006233d13cd58a978183d23c26b1159","ssdeep":"","tlshash":"c7418bea14fefb79dd05a752802d76f8f40f18a7c93194c7aae44c9480986a41b1e16d","size":2129,"data":"","first_seen":"2025-12-17T05:40:06.52315Z","last_seen":"2025-12-17T05:40:06.52315Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"7a1cc3260aad7b79d6eced86ec9ac421","sha1":"dae7330f394d4c20ec3b327c5d958d651b690809","sha256":"16be2c2486613ce45a3bc7840ae6917694b231ae6306d67523f2c30cdfaa6fb1","sha512":"6715a486ead1ba6a3e4de7e3dac866fa921b57d75a468c0cc63e549ad472cfe93aa2154dbc963b15f3fc03e33629328f41b11da54692bd34a2b6cabedde41e9e","ssdeep":"192:r89EANQ/yK3XqG+Vt+V7EANQ/yK3Xq5n1n7EANQ/yK3Xq0xhFxh7EANQ/yK3XqUY:r6DVYVdLn1ndYhDhdi666dcPd01moh","tlshash":"9ee111e655fef779de059792802e76f4e05e18f7d83160c6baf48c8840987b82b1e11e","size":7163,"data":"","first_seen":"2025-12-17T05:40:06.525267Z","last_seen":"2025-12-17T05:40:06.525267Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"b57168e56076afcafcb235b1451f23c0","sha1":"920b343526d8d0a3f1a9b03c374280e2cf6a2bc8","sha256":"07123bbdc4c12fd99d498eb0f731d85e84cbd8769a232d867161c80d6fa3c7d8","sha512":"726edb0bd9fd90fa6e1f5cf1b9b70a92d2fd1515159125cddf3c62cbc268763a03f130fb8664a46e930b182df5cb58de0ac7e86b3d58330e7e7b7004a31cafad","ssdeep":"96:r8SivsrOn6U95ywtmFQb2KQADANQ/v6KJNXqcmADANQ/v6KJNXqmtOnwSk2KQADZ:r8l0rOn6UOwtmi2KQEANQ/yK3Xq7EAN8","tlshash":"4ea101ba14befb79dd059b12002d76b4f80f18fbd93551c6baac8c5451dc2a42f1e22d","size":4746,"data":"","first_seen":"2025-12-17T05:40:06.526957Z","last_seen":"2025-12-17T05:40:06.526957Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sorrybizzy.xyz/rCcyjm?return=js.client\u0026\u0026se_referrer=\u0026default_keyword=RuTOR%20-%20%D0%A1%D0%B0%D0%BC%D1%8B%D0%B9%20%D0%B1%D0%BE%D0%BB%D1%8C%D1%88%D0%BE%D0%B9%20%D1%84%D0%BE%D1%80%D1%83%D0%BC%20%D0%B2%20%D0%A1%D0%9D%D0%93\u0026landing_url=rutorforum24x7.to%2Fphishing\u0026name=_MLL9k2cSxFHkcnfx\u0026host=https%3A%2F%2Fsorrybizzy.xyz%2FrCcyjm","fqdn":"sorrybizzy.xyz","domain":"sorrybizzy.xyz","tld":"xyz"},"ip":{"addr":"95.179.141.146","port":443,"asn":20473,"as":"AS-VULTR","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"f6a0e1d7fdf9a3f9e6b69a03a1b31e0c","sha1":"8339ed20db19c53d94f8bc80a55f78cbad866d6b","sha256":"f922a074002ebb285c1f9c816c5bf6cf0d6ab1c769a215e5f4570655e06fe8e3","sha512":"925a37a2e3f42beae3293a44aa855774b74be46cbf1052c0b6004c6bb04833fd0f6515bc339e516c16915f54f2ee976f72aa2a3bb0d4479944496e7b0961e41c","ssdeep":"","tlshash":"7f81a47b3879bd760342a4a0443b9215f93e48a8f05e90f4f3b8a4d92cf484d4266f75","size":3991,"data":"","first_seen":"2025-12-17T05:40:06.478746Z","last_seen":"2025-12-17T05:40:06.478746Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plausible.io/js/script.js","fqdn":"plausible.io","domain":"plausible.io","tld":"io"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"25b5b48c4c1efed79da2c557576bff85","sha1":"f441809be456048d32225ae0d47efaf1006efbe5","sha256":"a34d5ce3e989b828c42fe4994c8c1e21693c311db3b076fcbf5202cdc505e5ac","sha512":"7e68bb787c024fb14042a4ab95b7ad5d81750b357404865fab281d16e925a0f5e5149fc46f32549f73d57fd17052ff10ce323b28eefe34cf231f29457b00aac2","ssdeep":"","tlshash":"80512db96a02757909b9d167b62fb3163a3366263116b401542cd9c13e28eefc323ecd","size":3005,"data":"","first_seen":"2025-10-28T15:34:03.371103Z","last_seen":"2026-07-27T00:09:21.677707Z","times_seen":6559,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript;base64,CiAgICAoZnVuY3Rpb24oKSB7CiAgICB2YXIgbmFtZSA9ICdfTUxMOWsyY1N4RkhrY25meCc7CiAgICBpZiAoIXdpbmRvdy5fTUxMOWsyY1N4RkhrY25meCkgewogICAgICAgIHdpbmRvdy5fTUxMOWsyY1N4RkhrY25meCA9IHsKICAgICAgICAgICAgdW5pcXVlOiBmYWxzZSwKICAgICAgICAgICAgdHRsOiA4NjQwMCwKICAgICAgICAgICAgUl9QQVRIOiAnaHR0cHM6Ly9zb3JyeWJpenp5Lnh5ei9yQ2N5am0nLAogICAgICAgIH07CiAgICB9CiAgICBjb25zdCBfNXFkV1BxOTVqMnlNWjhReiA9IGxvY2FsU3RvcmFnZS5nZXRJdGVtKCdjb25maWcnKTsKICAgIGlmICh0eXBlb2YgXzVxZFdQcTk1ajJ5TVo4UXogIT09ICd1bmRlZmluZWQnICYmIF81cWRXUHE5NWoyeU1aOFF6ICE9PSBudWxsKSB7CiAgICAgICAgdmFyIF85aGZZZzQ4dDZ3N2JUVENnID0gSlNPTi5wYXJzZShfNXFkV1BxOTVqMnlNWjhReik7CiAgICAgICAgdmFyIF9UUkpKMm1DVGRDUG5SUkpWID0gTWF0aC5yb3VuZCgrbmV3IERhdGUoKS8xMDAwKTsKICAgICAgICBpZiAoXzloZllnNDh0Nnc3YlRUQ2cuY3JlYXRlZF9hdCArIHdpbmRvdy5fTUxMOWsyY1N4RkhrY25meC50dGwgPCBfVFJKSjJtQ1RkQ1BuUlJKVikgewogICAgICAgICAgICBsb2NhbFN0b3JhZ2UucmVtb3ZlSXRlbSgnc3ViSWQnKTsKICAgICAgICAgICAgbG9jYWxTdG9yYWdlLnJlbW92ZUl0ZW0oJ3Rva2VuJyk7CiAgICAgICAgICAgIGxvY2FsU3RvcmFnZS5yZW1vdmVJdGVtKCdjb25maWcnKTsKICAgICAgICB9CiAgICB9CiAgICB2YXIgX2s5ODZCY1c4OXp2TEI3aFogPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgnc3ViSWQnKTsKICAgIHZhciBfeVp2Vzh5R2RQdzFyVkg3QiA9IGxvY2FsU3RvcmFnZS5nZXRJdGVtKCd0b2tlbicpOwogICAgdmFyIF96VDQzc20zMWNRU0ZzWWMzID0gJz9yZXR1cm49anMuY2xpZW50JzsKICAgICAgICBfelQ0M3NtMzFjUVNGc1ljMyArPSAnJicgKyBkZWNvZGVVUklDb21wb25lbnQod2luZG93LmxvY2F0aW9uLnNlYXJjaC5yZXBsYWNlKCc/JywgJycpKTsKICAgICAgICBfelQ0M3NtMzFjUVNGc1ljMyArPSAnJnNlX3JlZmVycmVyPScgKyBlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQucmVmZXJyZXIpOwogICAgICAgIF96VDQzc20zMWNRU0ZzWWMzICs9ICcmZGVmYXVsdF9rZXl3b3JkPScgKyBlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQudGl0bGUpOwogICAgICAgIF96VDQzc20zMWNRU0ZzWWMzICs9ICcmbGFuZGluZ191cmw9JyArIGVuY29kZVVSSUNvbXBvbmVudChkb2N1bWVudC5sb2NhdGlvbi5ob3N0bmFtZSArIGRvY3VtZW50LmxvY2F0aW9uLnBhdGhuYW1lKTsKICAgICAgICBfelQ0M3NtMzFjUVNGc1ljMyArPSAnJm5hbWU9JyArIGVuY29kZVVSSUNvbXBvbmVudChuYW1lKTsKICAgICAgICBfelQ0M3NtMzFjUVNGc1ljMyArPSAnJmhvc3Q9JyArIGVuY29kZVVSSUNvbXBvbmVudCh3aW5kb3cuX01MTDlrMmNTeEZIa2NuZnguUl9QQVRIKTsKICAgIGlmICh0eXBlb2YgX2s5ODZCY1c4OXp2TEI3aFogIT09ICd1bmRlZmluZWQnICYmIF9rOTg2QmNXODl6dkxCN2haICYmIHdpbmRvdy5fTUxMOWsyY1N4RkhrY25meC51bmlxdWUpIHsKICAgICAgICBfelQ0M3NtMzFjUVNGc1ljMyArPSAnJnN1Yl9pZD0nICsgZW5jb2RlVVJJQ29tcG9uZW50KF9rOTg2QmNXODl6dkxCN2haKTsKICAgIH0KICAgIGlmICh0eXBlb2YgX3ladlc4eUdkUHcxclZIN0IgIT09ICd1bmRlZmluZWQnICYmIF95WnZXOHlHZFB3MXJWSDdCICYmIHdpbmRvdy5fTUxMOWsyY1N4RkhrY25meC51bmlxdWUpIHsKICAgICAgICBfelQ0M3NtMzFjUVNGc1ljMyArPSAnJnRva2VuPScgKyBlbmNvZGVVUklDb21wb25lbnQoX3ladlc4eUdkUHcxclZIN0IpOwogICAgfQogICAgaWYgKCcnICE9PSAnJykgewogICAgICAgIF96VDQzc20zMWNRU0ZzWWMzICs9ICcmYnlwYXNzX2NhY2hlPSc7CiAgICB9CiAgICB2YXIgYSA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ3NjcmlwdCcpOwogICAgICAgIGEudHlwZSA9ICdhcHBsaWNhdGlvbi9qYXZhc2NyaXB0JzsKICAgICAgICBhLnNyYyA9IHdpbmRvdy5fTUxMOWsyY1N4RkhrY25meC5SX1BBVEggKyBfelQ0M3NtMzFjUVNGc1ljMzsKICAgIHZhciBzID0gZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoJ3NjcmlwdCcpWzBdOwogICAgcy5wYXJlbnROb2RlLmluc2VydEJlZm9yZShhLCBzKQogICAgfSkoKTsKICAgIA==","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2c21d2132c28ac14929163c789cb51f","sha1":"0c1b0ff777abedfaa869e26cb0380e175086fc4f","sha256":"5afb834dcb8d0c4cd5f11d11a3c40fd4c50be81b3b0a05ef9c4fb98dffbaab1a","sha512":"bd8361018adeabace98e0f7667d9f5abe09572f76e2e2c98b1067cd10951dc166f5c051687b42d59fd4193338c847d67c5a73727670d1ee11b4fd715730df4ea","ssdeep":"","tlshash":"cb4111970893442614fb22312bab7374bbf57aa36c58c351ba1f41806fb591b27987ec","size":2215,"data":"","first_seen":"2025-12-17T05:40:06.530999Z","last_seen":"2025-12-17T05:40:06.530999Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"38164b9ebb842654e5e07f80110e1dab","sha1":"83c9e30e8eaa84a678352aa0daea9e325f58e1ca","sha256":"e530903f3420709c98d3c9f1c348b05f907eaa3b3fc514dfc151623841682285","sha512":"2daddb3326629a1795ed522ca816337bc5314fd75c67d04284d88b957b1bde001889d5e1aa78ce71007a1afc5d96fd61c06d3bec5ddd3b5ba747c29d20c4f776","ssdeep":"","tlshash":"2ed0ebd6b44648f165a908b733b1830472831a08240a1c33cefecc00589c28b0c16b8c","size":288,"data":"","first_seen":"2024-08-20T16:09:46.120201Z","last_seen":"2025-12-17T05:40:06.532647Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"8c6ef070c4f82d5723a0889a9811b327","sha1":"9c6f430196a4979da4e4c44db06f98f8810ac226","sha256":"ff6bf94201e6a1856a85d329a7722ae1f6e09e0fcb5728bd0a03c2bd26d9e4c1","sha512":"3bb171543c596bdd5d41e63d9e0804e4d0cad1121b652dbf5b70f5249425b2817ad303d156137ba265e58cbc371508ed2e9a3d3089cc09561f4f040179c30063","ssdeep":"","tlshash":"94f08b3e00def539ce1f6891102579a0a04f54be9465a4c6a2bcc850a0657743f1b17c","size":561,"data":"","first_seen":"2024-08-20T16:09:46.123342Z","last_seen":"2025-12-17T05:40:06.541025Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"71afacdf6a7a6d54ff1dbb5de48ed205","sha1":"e645c555d158f354ba5f6b789721594dc1867a6d","sha256":"bb834bd6260525c48f43fd6959dea44feaff43cf85f1003f91bea0e907e43e8f","sha512":"6edd60ae5f4a1aaeef7f502ed949e5c22c1de2a99380daf338e288876e4c0a52c37f3bc8eb0708d5ccd1aa49263d0db92de727657344e6482d3593f39f3e0a9c","ssdeep":"","tlshash":"3541cde615fefb79dd059792802d77f8f05e18e7c93190c6aae44c9440982b41f1e16d","size":2111,"data":"","first_seen":"2025-12-17T05:40:06.543576Z","last_seen":"2025-12-17T05:40:06.543576Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"a88af555fae83e1925d89a65cf326fb0","sha1":"86a1eb99b02038fcc39a30ced522b20efc40333b","sha256":"0bda189026226a94ed95380aeff7f8b6141b2238bebeecc1913c4f92d7186c80","sha512":"c623c281d7a16e4b851d2ed773fd63f20849f16cc7d2698bcc9cd93f70c4fd44016931b6ef13ffd004d966b00ea8dc7ca66a30e7f865821e150e7f3813057b55","ssdeep":"","tlshash":"6041adea00fefa79dd05a782c02e76b4f40f08e7c93190c6aae44c8444986a41f5e16d","size":2064,"data":"","first_seen":"2025-12-17T05:40:06.548136Z","last_seen":"2025-12-17T05:40:06.548136Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"daac20a758c64d72cb6ab91385846706","sha1":"d6ccb1844b78f83e33dcddec5f0862a07b592dcf","sha256":"a2a87a7e5949c10320d573a7a1b46abd44d4e26515668f78fc949378adc337e7","sha512":"633f9ef06704ecbfaff43a902ec090f0db6ea2ad962672a9fef19b9ca5509762a9c14adfaccba22522138094d77dee7a8c9764760d7857f40a6283f8b323fb68","ssdeep":"96:r82KQADANQ/v6KJNXqiGimADANQ/v6KJNXqrQiKQrmADANQ/v6KJNXq5ZcmADAN1:r82KQEANQ/yK3XqiGJEANQ/yK3XqrRKD","tlshash":"94c1ddea50bffb79dd06ab42416d76f4f40e18ebc43060c7bae44d8494986a42f1e26d","size":5941,"data":"","first_seen":"2025-12-17T05:40:06.549515Z","last_seen":"2025-12-17T05:40:06.549515Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rutorforum24x7.to/js/app.js","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /js/app.js HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/phishing\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: accept-encoding\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"6655739d-6d8fc\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dRnIvYUup0kne%2BXF0LObCoPD5O%2Bg9ZCcutjr0JRLVu3OBFuJxZAZjoJNIU4elptUSee7WuVZ13l6Dq%2BGHmwSWt4OP4tu05fDz0mLP35quw%3D%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: 9af414baf969568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":448764,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e4d52becb7e39dd075a8bc6da9d113c8","sha1":"055e0aa66aef9f8a49109b56d218630c63649097","sha256":"5e81b1162363347379f396828a98086ff36c87125527632d27e7f59390280940","sha512":"ed4b29e94fa871c39ae50e7062040d25c0706343f26ee4b2a77ecd3cfa04198eea2fae10b331ea97df3c84a3cda5e80d4dac5d8f617ffff0c06a3ad749dc7131","ssdeep":"6144:qARixCIKcxACFaFImJaNp3g7q00F0gRMG2ey5t+imubhIWg:/wICFaFIqaN5QhLt+im6y","tlshash":"cb94189db2d2b07547a762b0402f150bf23b6998744a80d8f639e8d57d7884ea13bf7c","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.46126Z","times_seen":3,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/images/bg_section-hero.webp","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:37.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /images/bg_section-hero.webp HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/phishing\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: image/webp\r\ncontent-length: 117874\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\netag: \"6655739d-1cc72\"\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dh1uYKTnmfHolWIIViQvTTGvQ37RVt9BRSFXYsG4173A8WuBMvSx4J%2FBVRCkWypFguQYG9kAuVXaccvAaD%2BqyBWUY6r7zL4xqB1h377TBg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9af414bd8977568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":117874,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5546e29c6cbce9880af10d5789c0265a","sha1":"7e79c66c90432881f6f52d061d483796679a613f","sha256":"a741784aef5f803442116905f2604505f2ff298910ac1f32ee8c9b818f51bf81","sha512":"1617804b2521c8805ae5c68da641b113b2309bdc67fa7c9bdae46ae77cfc3061072bccb8a9dc45dddf1bf50596574fa329a03df3c2bf5c11f6d3886f634de24c","ssdeep":"3072:+y3zCfbpJDQJleL3jsca8UjLK6ZTmsmE3+F0On:+SoIJ4Lzra8gZT/x3+9","tlshash":"b6b30270ea285c8535c87510b2dc9757f3622ca98e5335c0f4be5f237b1279ade26b06","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.464442Z","times_seen":3,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-S79VD4YDXT\u0026cx=c\u0026gtm=4e5ca1h1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:37.430Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 24 Nov 2025 08:39:01 GMT","end":"Mon, 16 Feb 2026 08:39:00 GMT"},"fingerprint":{"sha1":"3B:8E:72:21:DE:8E:AD:CE:CE:A1:03:B1:1B:8A:49:82:BF:EF:A7:67","sha256":"9F:15:0E:45:14:D4:7B:C5:3D:5B:E6:28:DF:D6:82:06:67:87:30:6B:A0:EC:B4:CE:F6:F3:CB:98:F5:12:A1:78"}}},"request":{"raw":"GET /gtag/js?id=G-S79VD4YDXT\u0026cx=c\u0026gtm=4e5ca1h1 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\nexpires: Wed, 17 Dec 2025 05:39:37 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 143275\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":433554,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6031)","md5":"a86e8be7d062ffcf84fa98b56609d052","sha1":"0fcd066e8bed1ba6743996e57c7665f53468b80c","sha256":"7336d7a6944b443fb8d5efbee6c8957bbef020693e5e747f20878c4fc9c3d8e2","sha512":"2b2efb2b301854520bc9e626bb1fe054fd515001881464f416b7f593ed958fb4726889b034e68755aefbd6cdff3babca6f0ff9299e5165bd971f661708d6b034","ssdeep":"6144:3LIe7ma2bulKY/1u99xHDmHYmyBFzvnsyRO6jJWoNPad4FpC1xY:cC8bu7/1mbrnsy39WbMpb","tlshash":"a4941ace73c674269396e078503f118ba57b29e2b45cc896f189cce42d74a9a4237f7c","first_seen":"2025-12-17T05:40:06.467781Z","last_seen":"2025-12-17T05:40:06.467781Z","times_seen":1,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/fonts/ultimate-team-bold.woff","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /fonts/ultimate-team-bold.woff HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/css/rtr.css\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: application/font-woff\r\ncontent-length: 56600\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\netag: \"6655739d-dd18\"\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cAMUY8ZYp7YyiHRC7S1zURYi3%2FkWt0DiL6XZEo6mTWEDmUwFWSR6UA1yibao5NKBGAgGigK%2FluQ6SgfJMD1FNqqbe0tLSxDmKoJAaU5gSw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9af414bbf96c568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56600,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, TrueType, length 56600, version 0.0","md5":"1942e381444c997e3d254743183c9636","sha1":"cc0f04bb0996c2c940f28e1aad5b925ee606bd23","sha256":"7ad7441537497c0a974e71fa2546e0803e6e23085b60d97b0628d6b3c855394d","sha512":"769ce3dede9fd91fbd630f37cc932b6990bba2f59e35e9eb303520bf251fd5d219367303ffec9a74f0ec84b9988037529886a8840e5c4423556538cfaec8b0eb","ssdeep":"1536:/BOG+LfMll/FsJtI2GDOFjj70okZbOhOi8frDTw:ZONoTQtIpgX9Ziw","tlshash":"eb4302a544bec9b4c3d3ed9b0367b767ba533c7ec734f8164ee926028a100db61905a8","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.470151Z","times_seen":3,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":74,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/fonts/roboto-condensed-bold.woff","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /fonts/roboto-condensed-bold.woff HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/css/rtr.css\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nlast-modified: Wed, 17 Dec 2025 05:39:37 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=btGkZMjz%2Bn%2BmlP%2BdJSTkHjwlMh4tJgQqrgyyflA2trwOKRHPXZqOArsQFW2DeAcACy9iRSBNCPlgfbe%2F5oFypevYDW4QGU7B%2BH8FexU7ig%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9af414bc196e568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"UIKit","description":"UIKit is the framework used for developing iOS applications.","website":"https://getuikit.com","common_platform_enumeration":"","icon":"UIKit.svg","categories":["UI frameworks"]}],"data":{"size":86284,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3010)","md5":"0a3b80bb89a5db0a71bc68d49a78e920","sha1":"726cc9b5bc4c3738934009abbf115595c727d9b0","sha256":"49ef5661966645c70980170035e9b17c658007208bce4ab464fd616269d7f0d3","sha512":"4933ac5dea98f34962c8dd0c2a17ac7028035b11e8646ce8a7eee7369f45e338ba7e18ab5d46e969628b9cc4c460b45d32cf5405691f7a516dafbbbda8074876","ssdeep":"1536:pwVXmaF/rA2c6KMKTKgKnKmKVKiKw6M6wR46O6r6Y60KwIRK+K/KsKZKgKjKMKB7:pwm6v6TiRQJxzDR4NEHL5IRDSZIfW5c7","tlshash":"9483dcb844f1343e6242c680aa727b6b6f55e913dd0b860173dc1fe16fd2d86ad432ad","first_seen":"2025-12-17T05:40:06.473285Z","last_seen":"2025-12-17T05:40:06.473285Z","times_seen":1,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/images/logo.png","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.801Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/phishing\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 3989\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\netag: \"6655739d-f95\"\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8hNDqs1XqQzZLDocESdZT2PgGW4UOF%2Bzd9Zti8%2B%2FhEKksPYzFQRjrRakDxo3es4trF7amzAZEO5d%2BubAYVTP6IybFeOyvz%2FvmNl76QBHqQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9af414baf967568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3989,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 135 x 63, 8-bit/color RGBA, non-interlaced","md5":"19d3a24846bdeac6ec77d15e97388dce","sha1":"67f6925f6c1b39f9fbf1cf2ae84519b4e885f1b5","sha256":"0a53cd446c1293ac7a7fb4a82ef1a4660e73fe758f3d7621d169129a8df1d263","sha512":"14b282460a19321459d9a77d25e7f4032d00c3d043a48562a1fb98f3c81f6ee479407fc697030894668c98f17737645a8fea87f013b416a85c9ce5216b7b59ab","ssdeep":"","tlshash":"cf817cc34a754b15b2aed9f311be2cdb2385a3400de1eabc30eab507681cc6d44662f3","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.476057Z","times_seen":3,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sorrybizzy.xyz/rCcyjm?return=js.client\u0026\u0026se_referrer=\u0026default_keyword=RuTOR%20-%20%D0%A1%D0%B0%D0%BC%D1%8B%D0%B9%20%D0%B1%D0%BE%D0%BB%D1%8C%D1%88%D0%BE%D0%B9%20%D1%84%D0%BE%D1%80%D1%83%D0%BC%20%D0%B2%20%D0%A1%D0%9D%D0%93\u0026landing_url=rutorforum24x7.to%2Fphishing\u0026name=_MLL9k2cSxFHkcnfx\u0026host=https%3A%2F%2Fsorrybizzy.xyz%2FrCcyjm","fqdn":"sorrybizzy.xyz","domain":"sorrybizzy.xyz","tld":"xyz"},"ip":{"addr":"95.179.141.146","port":443,"asn":20473,"as":"AS-VULTR","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"sorrybizzy.xyz","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 11:46:32 GMT","end":"Tue, 24 Feb 2026 11:46:31 GMT"},"fingerprint":{"sha1":"AE:2A:27:28:5A:05:36:8B:F9:05:AB:FD:1E:7B:BE:0B:FD:F3:45:17","sha256":"75:B9:F5:0D:E6:1A:58:6A:4D:82:52:37:3E:08:08:21:A7:94:FE:59:9E:FE:32:81:F7:F3:B0:B0:75:2E:8F:01"}}},"request":{"raw":"GET /rCcyjm?return=js.client\u0026\u0026se_referrer=\u0026default_keyword=RuTOR%20-%20%D0%A1%D0%B0%D0%BC%D1%8B%D0%B9%20%D0%B1%D0%BE%D0%BB%D1%8C%D1%88%D0%BE%D0%B9%20%D1%84%D0%BE%D1%80%D1%83%D0%BC%20%D0%B2%20%D0%A1%D0%9D%D0%93\u0026landing_url=rutorforum24x7.to%2Fphishing\u0026name=_MLL9k2cSxFHkcnfx\u0026host=https%3A%2F%2Fsorrybizzy.xyz%2FrCcyjm HTTP/1.1\r\nHost: sorrybizzy.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 05:39:37 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 1623\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, must-revalidate\r\nContent-Encoding: gzip\r\nExpires: Wed, 17 Dec 2025 05:39:37 GMT\r\nSet-Cookie: _subid=1sjos4f150822; expires=Fri, 26 Dec 2081 11:19:14 GMT; path=/rCcyjm; httponly\n85a13=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjE2M1wiOjE3NjU5NDk5Nzd9LFwiY2FtcGFpZ25zXCI6e1wiODVcIjoxNzY1OTQ5OTc3fSxcInRpbWVcIjoxNzY1OTQ5OTc3fSJ9.NgZD2FShUDqKgvN0etxJenvp493Zz7y20_aNgeerGsI; expires=Fri, 26 Dec 2081 11:19:14 GMT; path=/rCcyjm; httponly\r\nVary: Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3991,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3991), with no line terminators","md5":"f6a0e1d7fdf9a3f9e6b69a03a1b31e0c","sha1":"8339ed20db19c53d94f8bc80a55f78cbad866d6b","sha256":"f922a074002ebb285c1f9c816c5bf6cf0d6ab1c769a215e5f4570655e06fe8e3","sha512":"925a37a2e3f42beae3293a44aa855774b74be46cbf1052c0b6004c6bb04833fd0f6515bc339e516c16915f54f2ee976f72aa2a3bb0d4479944496e7b0961e41c","ssdeep":"","tlshash":"7f81a47b3879bd760342a4a0443b9215f93e48a8f05e90f4f3b8a4d92cf484d4266f75","first_seen":"2025-12-17T05:40:06.478746Z","last_seen":"2025-12-17T05:40:06.478746Z","times_seen":1,"resource_available":true,"data":null}},"time_used":220,"timings":{"blocked":92,"dns":39,"connect":17,"send":0,"wait":34,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtm.js?id=GTM-52LD25XR","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 24 Nov 2025 08:39:01 GMT","end":"Mon, 16 Feb 2026 08:39:00 GMT"},"fingerprint":{"sha1":"3B:8E:72:21:DE:8E:AD:CE:CE:A1:03:B1:1B:8A:49:82:BF:EF:A7:67","sha256":"9F:15:0E:45:14:D4:7B:C5:3D:5B:E6:28:DF:D6:82:06:67:87:30:6B:A0:EC:B4:CE:F6:F3:CB:98:F5:12:A1:78"}}},"request":{"raw":"GET /gtm.js?id=GTM-52LD25XR HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\nexpires: Wed, 17 Dec 2025 05:39:37 GMT\r\ncache-control: private, max-age=900\r\nlast-modified: Wed, 17 Dec 2025 03:00:00 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 106838\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":309823,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (5340)","md5":"9315fe3fa1fe791eddd4a22edb53d56f","sha1":"6f3f866a7a2f46ee16b3e6547a7c319d10501f95","sha256":"205f69ae8ddfc21da7d81144449a00d2ceaba7cd676079e7a17751c5fa28d3d0","sha512":"4bf26823694caf3e8adee41b59a042ffdca603da992a3052aa9860f68bfb5fa16d3441d5a235c129a6a3410c4436b1cd7874dc61a2a8500ebd17f1a44c5134b2","ssdeep":"6144:QIeJq2bulKYv9VHDmHYmyBFz0nsywWCxRnc:BSbu7llAns3WCxO","tlshash":"956418c9b3d6702683a3a474503f118ba17b79d2e84cc895f186dcd42e74aaa4237f7d","first_seen":"2025-12-17T05:40:06.480454Z","last_seen":"2025-12-17T05:40:06.480454Z","times_seen":1,"resource_available":true,"data":null}},"time_used":410,"timings":{"blocked":140,"dns":3,"connect":29,"send":0,"wait":59,"receive":68,"ssl":109},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/images/favicon_16.png","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:37.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /images/favicon_16.png HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/phishing\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 1580\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\netag: \"6655739d-62c\"\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wwKzzfoQMaMB7aWux9Hsr04LlWaEqb7nFAnOCZIqeiI%2BsyGQCXZzfzxb8%2F87X2YOHqxQ%2FwgD3OnzkGep9Wuj%2FCG0fA40n9nHfC9qTPgS2A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9af414bed97d568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1580,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"04b63e9ca2947f5cbbc75963e4d13800","sha1":"a8b179b59256f78b1a3796bd8c65e03cc774e4bb","sha256":"71fe78097ac49b17c1e392388e32c7822954d432a85311f1daf8641af3d0c0e8","sha512":"981dfaea7fce2f54f5aae93c6faf5c6a4b46a75432cd31264e55d1bb872f24390c7762e839bacbb4fbe4e8c3daf1491fb31a1f86e54833353ae3ddb23fa33314","ssdeep":"","tlshash":"2f317349f811ac10570ee824a8fe419b26379bc49180a8aabec9cc8369351fadd1c5d3","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.483795Z","times_seen":2,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/phishing","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-17T05:39:36.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /phishing HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 05:39:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nset-cookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5; expires=Thu, 18-Dec-2025 00:00:00 GMT; Max-Age=66024; path=/\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NNtm0WJGMHuyPOMovVokJQ8If3AkUUsrfXBaAcwnx7c49jSv2dvxN4DGmDnAzZF%2FaErx%2BwcT52i1N0EKQ17eDgQGSmQM5s2XaSYjaeU1Ng%3D%3D\"}]}\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9af414b9788956ca-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"UIKit","description":"UIKit is the framework used for developing iOS applications.","website":"https://getuikit.com","common_platform_enumeration":"","icon":"UIKit.svg","categories":["UI frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":84796,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3010)","md5":"9d332cf78ea5baf590528a0121ecdca6","sha1":"17e353ead599120476566c45762513029f4a1df4","sha256":"709c5e5ee9f1b6d2ff618a23aab259c987d89a8ba9c1aab6c05bc2826d9b7ac3","sha512":"4e3ce281123a02b132d03287943c9a949097fa5b148ca9790f090b2b361bd75375aa6ba407c4b63c5261559921d2a95d9ff530d42c781b91702d09fb7066aa40","ssdeep":"1536:pwVXmaF/rA2c6KAK3KcKrKqKpKeK06M6wR46O6r6Y60KwCfKiKDKMKVKYKrKgKBf:pwm6b2XuNcNdzDR4NEHL5Cfb6tobutAf","tlshash":"7f83ebb844f1743e51828680aa727a6b6f45e943dd1b860173ec1fe16fc2cd6ee431ad","first_seen":"2025-12-17T05:40:06.485452Z","last_seen":"2025-12-17T05:40:06.485452Z","times_seen":1,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":18,"dns":4,"connect":1,"send":0,"wait":49,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/fonts/roboto-condensed-regular.woff","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /fonts/roboto-condensed-regular.woff HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/css/rtr.css\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: application/font-woff\r\ncontent-length: 85472\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\netag: \"6655739d-14de0\"\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QtxabeN3rs6llwEDXI7hl4RSfc3K0FzW1QV%2BPol6%2BbtfbZil%2FTkYHBdndOMHwrb3AQ6fXdeCcb8eKiJK9DklGjm%2BOlpMb%2F9oORBZzB2whg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9af414bc096d568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":85472,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, TrueType, length 85472, version 1.1","md5":"1cb153bec75d944bd485ac03d59f8582","sha1":"d1f0b9da6277bf4ad0b34c0560a0578e7ea5b9ae","sha256":"8c76e22108b4d6f68090ea615954220c74f113e1121b55b680a7f2bda11ccc09","sha512":"0421c5b474d05ac6c31e2a19d8f5274e77d906ec674c1b9c0c1fdbd55346eff45ab11a2ca927dd49d238b50acf96ebd65800787306b9b05311a756fc4e5917a5","ssdeep":"1536:STcBHw4eGFO5MHKOYV3MdFGhPowDrBS52XQizBXHAgU:STcB1eHdVc/aAOHXLgT","tlshash":"be8301be9fa8ebd1c92135f27e8712ce6e43989598e25459cf3c7cd72e108e05d44931","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.49151Z","times_seen":5,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":85,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/fonts/roboto-condensed-bold.woff2","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:37.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /fonts/roboto-condensed-bold.woff2 HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/css/rtr.css\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nlast-modified: Wed, 17 Dec 2025 05:39:37 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4ObHuq%2FcJU2ClmYF3P9n4WGT8BjfPAi%2FwuOaFSuTfX9fmfosX74aQZqXYCtLTu%2Bv%2BYqywh2htIvIZnNCEkGGP38RHAyPtmWInpC%2FpPHy6w%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9af414be197c568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"UIKit","description":"UIKit is the framework used for developing iOS applications.","website":"https://getuikit.com","common_platform_enumeration":"","icon":"UIKit.svg","categories":["UI frameworks"]}],"data":{"size":86346,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3010)","md5":"f4c068d9348392cad8651dab089ff429","sha1":"a65890aa21eb7e6a1478a24f7a95f70f8270e453","sha256":"f165753b3597ab1c096a5e3d5938201881f04692e8c88cbac54e77c1ad0752b3","sha512":"22c2b31d01793a7ecdff747bfc59e18a58fd9bb3c09eba345d539098776852460a4a04c71cc51fdcee311c80d731e39a1d52c2d2a909022a253098de6102e861","ssdeep":"1536:pwVXmaF/rA2c6KyKbKOKDK8KzKoKO6M6wR46O6r6Y60Kw6nK+KvKcKFKQKzKCKBz:pwm6VGZi/evfzDR4NEHL56nbyZA3GHEz","tlshash":"a383dca844f1743e5282c681aa727b6b6f45e913dd0b860173dc1fe16fd3c86ad432ad","first_seen":"2025-12-17T05:40:06.493489Z","last_seen":"2025-12-17T05:40:06.493489Z","times_seen":1,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":9,"dns":0,"connect":0,"send":0,"wait":92,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"plausible.io/api/event","fqdn":"plausible.io","domain":"plausible.io","tld":"io"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:37.515Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"plausible.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 20:09:47 GMT","end":"Sat, 14 Feb 2026 20:09:46 GMT"},"fingerprint":{"sha1":"A3:B1:40:5E:58:17:30:60:8D:55:64:BA:D5:D8:AE:AC:A3:5E:68:91","sha256":"98:6D:01:16:D6:F1:8A:5C:8E:6A:D9:2A:B5:83:83:1B:60:B0:A2:BA:EB:FA:48:00:99:6A:B9:D1:0C:4B:7E:10"}}},"request":{"raw":"POST /api/event HTTP/1.1\r\nHost: plausible.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rutorforum24x7.to/\r\nContent-Type: text/plain\r\nContent-Length: 82\r\nOrigin: https://rutorforum24x7.to\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":82,"data":"{\"n\":\"pageview\",\"v\":33,\"u\":\"https://rutorforum24x7.to/phishing\",\"d\":null,\"r\":null}"}},"response":{"raw":"HTTP/2 202 Accepted\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: 2\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 682664\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\ncache-control: must-revalidate, max-age=0, private\r\nvia: 1.1 Caddy\r\napplication: 127.0.0.1\r\npermissions-policy: interest-cohort=()\r\nx-plausible-dropped: 1\r\nx-request-id: GIHqJe7U2JOF_Rlc-RiE\r\ncdn-proxyver: 1.41\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 202\r\ncdn-cachedat: 12/17/2025 05:39:37\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 6b5eabb8e29647090dbdea41c1145879\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-07-27T03:53:02.80106Z","times_seen":442612,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":14,"dns":1,"connect":1,"send":0,"wait":35,"receive":0,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/css/rtr.css","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.797Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /css/rtr.css HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/phishing\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:36 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\netag: W/\"6655739d-24fc5\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f7fUhiLxXN3jibrVv3wJGg3tZuSZkfQ8ap3ruaVAq8clHjiA61ZHTS6FHHY1EyFxge54GF4VK4rT%2FqBSQfm3%2BVJM%2B2cdhHj4ocEBSS%2Br8w%3D%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9af414bae966568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":151493,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"2b88fc8a5f11eac037321920d185a466","sha1":"9ab6b68929e0dfb236117bba3755068077eb7ec0","sha256":"7bb7af1667a84f3b5312a15f41490fbe30555d46b796706b5e3d2a7421d5cc4e","sha512":"3530bb47a4523f8aa7af384b0c25579147862c0ed9ad41ca2cf33bd85cb682b6e8c1ac64af6bbd3c7c8393b75902c0106c4a947853b4427a424c38b9619d395e","ssdeep":"1536:eXUgy99mjyVWWRAD4femnF3EAjyt4BsYl:phmjcRfeQytYl","tlshash":"ade35111a64320cfd3538f58a7f0aa76ff254af09f2bc5eeb0dd105883c89a51562add","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.496783Z","times_seen":3,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rutorforum24x7.to/images/sm.webp","fqdn":"rutorforum24x7.to","domain":"rutorforum24x7.to","tld":"to"},"ip":{"addr":"104.26.6.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"rutorforum24x7.to","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 05:51:36 GMT","end":"Tue, 27 Jan 2026 06:50:14 GMT"},"fingerprint":{"sha1":"A2:CF:BF:7A:06:3B:AF:17:E8:50:D6:3A:14:96:71:8B:27:D0:CC:3D","sha256":"AD:C0:52:4F:71:E4:93:36:C6:A5:18:58:48:1F:F1:16:32:AA:4C:29:0A:D2:6D:FD:50:58:A6:5E:99:14:6A:C8"}}},"request":{"raw":"GET /images/sm.webp HTTP/1.1\r\nHost: rutorforum24x7.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/phishing\r\nCookie: mob_stat=5212bb653e129adaba5037ebb45c3dd5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Wed, 17 Dec 2025 05:39:36 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14708\r\nlast-modified: Tue, 28 May 2024 06:03:09 GMT\r\netag: \"6655739d-3974\"\r\nx-robots-tag: noindex, nofollow, nosnippet, noarchieve\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7eFhoMjE0GvxhjL4%2FiFWZih3%2Fzr%2FHDAZbQngchWK2EHFkOQXzfDCyI5Xna8I2mXFnulBwop75z%2B3m6HI8Q%2FtPSCBlgcWIzvREs0tTdXQ2Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9af414baf968568a-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14708,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"94c1f72e026adf225538ddf1e26b970d","sha1":"8f35306a6932cef4556f39bb256431d1bb7c3e5c","sha256":"fec80820832346ed2e6ad07ce3c2bf46399ebef40c194559fef05bac61de8142","sha512":"be1926963a31a4e1dff1efc0f5d20d4d6f8f205a09d13b3615529458c1552156f154357c2a2e64de041b4778ed1586cf02f96f60cf29efda9d004b711f59e0bc","ssdeep":"384:wxIG/3FxAsfvYMCQBwWW3WGeTZ5QMFv41:MIU3FasXnCQBw73Xe/NFv41","tlshash":"b362bf10f6c73c46a86a1e3d78dc36411d2091795b72e170ae2ab56bd6f3834ad8dc8c","first_seen":"2023-12-11T03:56:15Z","last_seen":"2025-12-17T05:40:06.500334Z","times_seen":3,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"rutorforum24x7.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"image.limo/file/191e36ae-74dd-4183-9efc-0896d86a7d0a","fqdn":"image.limo","domain":"image.limo","tld":"limo"},"ip":{"addr":"172.67.221.202","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:36.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"image.limo","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Thu, 11 Dec 2025 22:26:11 GMT","end":"Wed, 11 Mar 2026 22:34:39 GMT"},"fingerprint":{"sha1":"88:22:24:74:51:28:6D:6E:77:7D:E6:BB:F1:81:67:12:E5:CB:A9:6E","sha256":"B5:B9:F2:03:45:E7:92:86:2A:44:96:56:9B:D2:20:0D:F1:FC:F9:02:8F:B9:04:E4:08:23:A6:39:FF:17:10:6A"}}},"request":{"raw":"GET /file/191e36ae-74dd-4183-9efc-0896d86a7d0a HTTP/1.1\r\nHost: image.limo\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 05:39:36 GMT\r\ncontent-type: image/png\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-powered-by: Express\r\nlast-modified: Wed, 17 Dec 2025 04:23:48 GMT\r\nage: 4548\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5Cepyklm4P6uafnl%2Ft0uHlKjXyv1cZEz2Sj%2F3mJtLBGVFMwNHcnl9RXBFeVM30HDhiZ76faKdQTb2ox570XrKO4YsoAIVfaS\"}]}\r\ncf-ray: 9af414bb2bde7127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":2316,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 56 x 64, 8-bit/color RGBA, non-interlaced","md5":"01f54347cb8466f0426a8098a81c9156","sha1":"0c5b19f85512752ba24f7361614b39d96609c1f9","sha256":"5af2ba0624d62954aa5c51c5fc4d422355c560bb8a48ad50b55f7ed273cbc7bb","sha512":"fd8a8c6ce4d3f4ffff061b10141f40d09a96c854a67366fc4a0c34d196297ccf9454a05a213930efe0d4e6339f3f27e1b08eded46a3e87876b0089556b2ca49c","ssdeep":"","tlshash":"7a415bdccb38c88f5d872403f1947a061375a420cd6b614ab6c2a800b3b5bf6489372d","first_seen":"2023-12-11T03:56:15Z","last_seen":"2026-04-20T20:18:17.926337Z","times_seen":13,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":20,"dns":4,"connect":1,"send":0,"wait":10,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plausible.io/js/script.js","fqdn":"plausible.io","domain":"plausible.io","tld":"io"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rutorforum24x7.to/phishing","date":"2025-12-17T05:39:37.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"plausible.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 16 Nov 2025 20:09:47 GMT","end":"Sat, 14 Feb 2026 20:09:46 GMT"},"fingerprint":{"sha1":"A3:B1:40:5E:58:17:30:60:8D:55:64:BA:D5:D8:AE:AC:A3:5E:68:91","sha256":"98:6D:01:16:D6:F1:8A:5C:8E:6A:D9:2A:B5:83:83:1B:60:B0:A2:BA:EB:FA:48:00:99:6A:B9:D1:0C:4B:7E:10"}}},"request":{"raw":"GET /js/script.js HTTP/1.1\r\nHost: plausible.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rutorforum24x7.to/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 05:39:37 GMT\r\ncontent-type: application/javascript\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 682664\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, must-revalidate, max-age=86400\r\ncontent-encoding: br\r\nvia: 1.1 Caddy\r\napplication: 127.0.0.1\r\ncross-origin-resource-policy: cross-origin\r\npermissions-policy: interest-cohort=()\r\nx-content-type-options: nosniff\r\ncdn-proxyver: 1.41\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 12/16/2025 16:55:29\r\ncdn-edgestorageid: 830\r\ncdn-requestid: ccfe1ed10a95b7dc51a457c9f015f397\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":3005,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3005), with no line terminators","md5":"25b5b48c4c1efed79da2c557576bff85","sha1":"f441809be456048d32225ae0d47efaf1006efbe5","sha256":"a34d5ce3e989b828c42fe4994c8c1e21693c311db3b076fcbf5202cdc505e5ac","sha512":"7e68bb787c024fb14042a4ab95b7ad5d81750b357404865fab281d16e925a0f5e5149fc46f32549f73d57fd17052ff10ce323b28eefe34cf231f29457b00aac2","ssdeep":"","tlshash":"80512db96a02757909b9d167b62fb3163a3366263116b401542cd9c13e28eefc323ecd","first_seen":"2025-10-28T15:34:03.371103Z","last_seen":"2026-07-27T00:09:21.677707Z","times_seen":6559,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":27,"dns":10,"connect":1,"send":0,"wait":2,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}