{"report_id":"61b4c1c8-623e-4742-9070-86a0b47bf6fd","version":6,"status":"done","tags":[],"date":"2026-05-20T07:31:30Z","url":{"schema":"http","addr":"atgamipost.web.app/","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":0,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"atgamipost.web.app/","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"title":"Monty python series netflix","dom":{"size":19297,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (19297), with no line terminators","md5":"f2b701281d96f36f0c28c8634dcb2b19","sha1":"2bb0f635b44d5e5dbc7eb5065f2b7f9792034430","sha256":"f74014b8986884b6e5e9110e9018f127fd39f1831c44d3ebaf4884c054efe75e","sha512":"93d87a98c2422fe9fe819a530978fd79fcf47b4d2c8b6c12267099676d7f6becd5199a35b64c811f267a42ac78de77b310fde52a5072c5a41ec2f0e83d2ee229","ssdeep":"384:e4uxs5eQUhZWuB12UC8QOkODPkD+7hZUx5PbXhn1prsVsIue:lGWoEePcHBArue","tlshash":"1f8275778649533e523a028bb52a7286b30b60f9bb161bdd5cfd602c2fa3c6946313d4","dom_hash":"domhashfbd1c0f288079920169f389679c52372","first_seen":"2026-05-20T07:31:35.038554Z","last_seen":"2026-05-20T07:31:35.038554Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"atgamipost.web.app/","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":0,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-24T07:31:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":2}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-05-20T07:31:08Z","timestamp":1779262268,"ip_dst":{"addr":"46.101.165.137","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"Germany","country_code":"DE"},"ip_src":{"addr":"Client IP","port":54530,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2026-05-20T07:31:08.229566+0000\",\"flow_id\":1260175134322841,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.10\",\"src_port\":54530,\"dest_ip\":\"46.101.165.137\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"mizadolevu.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":916,\"bytes_toclient\":3430,\"start\":\"2026-05-20T07:31:08.159897+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"atgamipost.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"atgamipost.web.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"atgamipost.web.app","ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-20T07:31:30.413545Z","last_seen":"2026-05-20T07:31:30.413545Z","alert_count":6,"request_count":3,"received_data":40765,"sent_data":1354,"comment":"","tags":null,"fingerprints":[{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"mizadolevu.icu","ip":{"addr":"46.101.165.137","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"Germany","country_code":"DE"},"domain_registered":"2024-05-22","domain_rank":0,"first_seen":"2026-05-15T05:49:52.700314Z","last_seen":"2026-05-15T05:49:52.700315Z","alert_count":0,"request_count":2,"received_data":2659,"sent_data":1147,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"atgamipost.web.app/","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"66c9cc6639665106be34f0ebf635e63c","sha1":"ee93081fb07d36025e1aefdc0b5ee3b77016926f","sha256":"c3d753c61a7a1881c24831e442975e68611dfc15d4b3ab2c7cd23dff32d24a79","sha512":"0eea9eafd2e02de7ddb17aa927acfd1493b4af4c8cfc0df0880d9507336c6b23dca41d9d1cf8cdab03a109ae2f390342cbe98a1b989b10ac62d26361809d2bc2","ssdeep":"","tlshash":"ed11c03617ba45ec8ef119c20dbfa0834cf94f508d89d0944a22f85399e4bd396b9f25","size":916,"data":"","first_seen":"2026-05-20T07:31:35.048342Z","last_seen":"2026-05-20T07:31:35.048342Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mizadolevu.icu/rrXrfk?return=js.client\u0026\u0026se_referrer=\u0026default_keyword=Monty%20python%20series%20netflix\u0026landing_url=atgamipost.web.app%2F\u0026name=_GJ94kQrdpMvsLW4d\u0026host=https%3A%2F%2Fmizadolevu.icu%2FrrXrfk","fqdn":"mizadolevu.icu","domain":"mizadolevu.icu","tld":"icu"},"ip":{"addr":"46.101.165.137","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"ca8c7ab5a94373af0f8c9fafdffd7821","sha1":"bdbcc8ae6a5578ca6e53b6ee466be4a1c970af73","sha256":"7ec5925e402ec200da8a5317064a48b9030c6d0a9e5fa0fad5ef9fe52fc58c3c","sha512":"485dee1a162facd2f47b57cef9d5f4c47db8099de892cc29cbbaaea89f1ce1c1781018815962756995dfc219ed0ae57cefc4a7d34091f8ada6d0f62a52a0b215","ssdeep":"","tlshash":"d841449b34f390a2a5b32279496f545cb1b7a913214ed0e1d1610b9c2f9c62d46affcc","size":1884,"data":"","first_seen":"2026-05-20T07:31:35.045161Z","last_seen":"2026-05-20T07:31:35.045161Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atgamipost.web.app/","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"55934ff82ff2b6cf4c0466384510f1e9","sha1":"d71e008c5185fe478d1ad5573e442bb768eb3b4d","sha256":"bb64646df11568bfd10ec170ad1af82caa53738f89130541e8c321cfa5a68ee7","sha512":"9c43aaa776b8b59d75dd64659fd602eb05a2a180cf809066daa9c16e8b1f18c0dc3fc4135c2b3f78a75e5dc65129d0f8965548d1806c342ebb13c36877629e5e","ssdeep":"","tlshash":"6c51d0743485b0f942772477e7ff140fb668a8e27dcc64449090e0e0797a538d72ae4e","size":2661,"data":"","first_seen":"2026-05-20T07:31:35.049464Z","last_seen":"2026-05-20T07:31:35.049464Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atgamipost.web.app/k1ucyr7sir.js","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b9c81cbc73edc3193029b7e654eaa3ac","sha1":"e94cc3ffee24aa164d4edec603355f718f2d2f88","sha256":"512f31176b6433d8e888365b5c91cefa878056d261970ea7c60705155efc3772","sha512":"e7f99e7897f05d80b4f3fe72bb131624b64cfcc1493a69728c8e7db2579ece5f73cacc0194406d5fdd0c70760704d6bfc5e3ccdc0c0a5cb54d173d8ff8809a31","ssdeep":"","tlshash":"04715ca22aaa7d8510577cc4cfff0d7a478ebc76a206cc1c5c81e19b57beb056634e24","size":3504,"data":"","first_seen":"2026-05-20T07:31:35.043742Z","last_seen":"2026-05-20T07:31:35.043742Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"atgamipost.web.app/","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-20T07:31:07.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.app","organization":""},"issuer":{"commonName":"WR4","organization":"Google Trust Services"},"validity":{"start":"Fri, 20 Mar 2026 16:23:07 GMT","end":"Thu, 18 Jun 2026 16:23:06 GMT"},"fingerprint":{"sha1":"BE:D1:01:2B:DD:AE:2E:C1:88:8D:14:24:87:DE:A3:C4:61:0C:8C:F3","sha256":"38:E3:C9:2D:48:5D:84:E6:17:95:F0:95:CB:3C:5F:8D:B0:70:98:CD:4F:AA:45:3F:26:56:68:22:10:22:A6:FC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: atgamipost.web.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=3600\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\netag: \"078700352ad460ce637c51227f74a37592d2d3bd8c0ed3ae88ca94ddd712647f-br\"\r\nlast-modified: Sat, 09 Jan 2021 17:07:57 GMT\r\nstrict-transport-security: max-age=31556926; includeSubDomains; preload\r\naccept-ranges: bytes\r\ndate: Wed, 20 May 2026 07:31:07 GMT\r\nx-served-by: cache-hel1410021-HEL\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1779262267.425818,VS0,VE1\r\nvary: x-fh-requested-host, accept-encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 4568\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19032,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (19032), with no line terminators","md5":"5c4418731c2601799a01412148894f67","sha1":"c8f1f247733181af1a1e185bf557b8b420522867","sha256":"ff13c5a31058d172cf349a35124dc955807a426bc655c40df91b32a6210cb140","sha512":"430d96252c9827f0956e522835c070c29737746c95cdcc221fda89b3fc85781da9efb8641264e7aad05c19295437bc1b2e86786d3c7d5e4d4d5aceab0494cb64","ssdeep":"384:m4uxs5eQUhZWuB12UC8QOkODPkD+7hZUx5PbXhn1prsVsIue:dGWoEePcHBArue","tlshash":"888265778649533e523a028bb56a7286b30b60f9bb161bdd1cfd702c2fa3c6946713d4","first_seen":"2026-05-20T07:31:35.042126Z","last_seen":"2026-05-20T07:31:35.042126Z","times_seen":1,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":36,"dns":1,"connect":13,"send":0,"wait":14,"receive":1,"ssl":19},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"atgamipost.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"atgamipost.web.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"atgamipost.web.app/k1ucyr7sir.js","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atgamipost.web.app/","date":"2026-05-20T07:31:07.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.app","organization":""},"issuer":{"commonName":"WR4","organization":"Google Trust Services"},"validity":{"start":"Fri, 20 Mar 2026 16:23:07 GMT","end":"Thu, 18 Jun 2026 16:23:06 GMT"},"fingerprint":{"sha1":"BE:D1:01:2B:DD:AE:2E:C1:88:8D:14:24:87:DE:A3:C4:61:0C:8C:F3","sha256":"38:E3:C9:2D:48:5D:84:E6:17:95:F0:95:CB:3C:5F:8D:B0:70:98:CD:4F:AA:45:3F:26:56:68:22:10:22:A6:FC"}}},"request":{"raw":"GET /k1ucyr7sir.js HTTP/1.1\r\nHost: atgamipost.web.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atgamipost.web.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 2522\r\ncache-control: max-age=3600\r\ncontent-encoding: br\r\ncontent-type: text/javascript; charset=utf-8\r\netag: \"8989aade0993d034b4f2b7f640e447be550ece8cc101d67321c9de0631786434-br\"\r\nlast-modified: Sat, 09 Jan 2021 17:07:57 GMT\r\nstrict-transport-security: max-age=31556926; includeSubDomains; preload\r\naccept-ranges: bytes\r\ndate: Wed, 20 May 2026 07:31:08 GMT\r\nx-served-by: cache-hel1410028-HEL\r\nx-cache: MISS\r\nx-cache-hits: 0\r\nx-timer: S1779262268.640817,VS0,VE392\r\nvary: x-fh-requested-host, accept-encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]}],"data":{"size":3504,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3504), with no line terminators","md5":"b9c81cbc73edc3193029b7e654eaa3ac","sha1":"e94cc3ffee24aa164d4edec603355f718f2d2f88","sha256":"512f31176b6433d8e888365b5c91cefa878056d261970ea7c60705155efc3772","sha512":"e7f99e7897f05d80b4f3fe72bb131624b64cfcc1493a69728c8e7db2579ece5f73cacc0194406d5fdd0c70760704d6bfc5e3ccdc0c0a5cb54d173d8ff8809a31","ssdeep":"","tlshash":"04715ca22aaa7d8510577cc4cfff0d7a478ebc76a206cc1c5c81e19b57beb056634e24","first_seen":"2026-05-20T07:31:35.043742Z","last_seen":"2026-05-20T07:31:35.043742Z","times_seen":1,"resource_available":true,"data":null}},"time_used":420,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":420,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"atgamipost.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"atgamipost.web.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mizadolevu.icu/rrXrfk?return=js.client\u0026\u0026se_referrer=\u0026default_keyword=Monty%20python%20series%20netflix\u0026landing_url=atgamipost.web.app%2F\u0026name=_GJ94kQrdpMvsLW4d\u0026host=https%3A%2F%2Fmizadolevu.icu%2FrrXrfk","fqdn":"mizadolevu.icu","domain":"mizadolevu.icu","tld":"icu"},"ip":{"addr":"46.101.165.137","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://atgamipost.web.app/","date":"2026-05-20T07:31:08.069Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mizadolevu.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 18 May 2026 21:50:27 GMT","end":"Sun, 16 Aug 2026 21:50:26 GMT"},"fingerprint":{"sha1":"14:55:C7:24:D6:C9:BB:DB:7D:59:84:90:4E:4B:85:F4:7F:49:97:E5","sha256":"E7:6D:6B:AD:6D:06:C8:54:7E:DB:D6:EB:67:39:82:56:00:76:E0:4F:8B:3D:97:68:7D:BD:AA:94:4C:FC:72:A1"}}},"request":{"raw":"GET /rrXrfk?return=js.client\u0026\u0026se_referrer=\u0026default_keyword=Monty%20python%20series%20netflix\u0026landing_url=atgamipost.web.app%2F\u0026name=_GJ94kQrdpMvsLW4d\u0026host=https%3A%2F%2Fmizadolevu.icu%2FrrXrfk HTTP/1.1\r\nHost: mizadolevu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atgamipost.web.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List\r\ncache-control: no-store\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 1884\r\netag: W/\"75c-vbzIrmpVeMpuU7buRmvkoclwr3M\"\r\ndate: Wed, 20 May 2026 07:31:08 GMT\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1884,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"ca8c7ab5a94373af0f8c9fafdffd7821","sha1":"bdbcc8ae6a5578ca6e53b6ee466be4a1c970af73","sha256":"7ec5925e402ec200da8a5317064a48b9030c6d0a9e5fa0fad5ef9fe52fc58c3c","sha512":"485dee1a162facd2f47b57cef9d5f4c47db8099de892cc29cbbaaea89f1ce1c1781018815962756995dfc219ed0ae57cefc4a7d34091f8ada6d0f62a52a0b215","ssdeep":"","tlshash":"d841449b34f390a2a5b32279496f545cb1b7a913214ed0e1d1610b9c2f9c62d46affcc","first_seen":"2026-05-20T07:31:35.045161Z","last_seen":"2026-05-20T07:31:35.045161Z","times_seen":1,"resource_available":true,"data":null}},"time_used":369,"timings":{"blocked":166,"dns":92,"connect":33,"send":0,"wait":36,"receive":0,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"atgamipost.web.app/favicon.ico","fqdn":"atgamipost.web.app","domain":"atgamipost.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://atgamipost.web.app/","date":"2026-05-20T07:31:08.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.app","organization":""},"issuer":{"commonName":"WR4","organization":"Google Trust Services"},"validity":{"start":"Fri, 20 Mar 2026 16:23:07 GMT","end":"Thu, 18 Jun 2026 16:23:06 GMT"},"fingerprint":{"sha1":"BE:D1:01:2B:DD:AE:2E:C1:88:8D:14:24:87:DE:A3:C4:61:0C:8C:F3","sha256":"38:E3:C9:2D:48:5D:84:E6:17:95:F0:95:CB:3C:5F:8D:B0:70:98:CD:4F:AA:45:3F:26:56:68:22:10:22:A6:FC"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: atgamipost.web.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atgamipost.web.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ncontent-length: 5750\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\ncontent-type: text/html; charset=utf-8\r\netag: \"72cac53d180ec56bf6941fa31601de5a49517cb92fb44a312f5d5b48ebee4722\"\r\nlast-modified: Sat, 09 Jan 2021 17:07:57 GMT\r\nstrict-transport-security: max-age=31556926; includeSubDomains; preload\r\naccept-ranges: bytes\r\ndate: Wed, 20 May 2026 07:31:08 GMT\r\nx-served-by: cache-hel1410028-HEL\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1779262268.194425,VS0,VE1\r\nvary: x-fh-requested-host, accept-encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16379,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (16379), with no line terminators","md5":"ba9ec8c7711a4b8d02ee06fc6cf20d82","sha1":"feb28288bf213184471ec18ff2104b3a0ee88df5","sha256":"80c3103b681cb880f1363914ec01e18ee06f7ff92ea09e80183e102d809f980d","sha512":"4faf51ba5e6d90546004e973a8f0888a79f3d8718ad39e0f9007c71260ceb975dada6d6571a1020bde9b48d7950378ecf1b301d6a6198e71c7c8ff98977daa35","ssdeep":"384:L4LgfO9sdn7X43Zx0rjziZd/OK1c6Af7HB/3z3//G8KiZ:8+O9sdnA+jzCdWK18f7HBPj3G8KA","tlshash":"e972957fc7883137975300e0b246335bf717429abb96ca16586a6518bb77a2c43332ce","first_seen":"2026-05-20T07:31:35.046366Z","last_seen":"2026-05-20T07:31:35.046366Z","times_seen":1,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":29,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-20","alert":"Phishing Block","trigger":"atgamipost.web.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"atgamipost.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mizadolevu.icu/index.php?cs=8c22c05254bc141cdb1e97b31428ea34","fqdn":"mizadolevu.icu","domain":"mizadolevu.icu","tld":"icu"},"ip":{"addr":"46.101.165.137","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://atgamipost.web.app/","date":"2026-05-20T07:31:08.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mizadolevu.icu","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 18 May 2026 21:50:27 GMT","end":"Sun, 16 Aug 2026 21:50:26 GMT"},"fingerprint":{"sha1":"14:55:C7:24:D6:C9:BB:DB:7D:59:84:90:4E:4B:85:F4:7F:49:97:E5","sha256":"E7:6D:6B:AD:6D:06:C8:54:7E:DB:D6:EB:67:39:82:56:00:76:E0:4F:8B:3D:97:68:7D:BD:AA:94:4C:FC:72:A1"}}},"request":{"raw":"POST /index.php?cs=8c22c05254bc141cdb1e97b31428ea34 HTTP/1.1\r\nHost: mizadolevu.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 164\r\nOrigin: https://atgamipost.web.app\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://atgamipost.web.app/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":164,"data":"vhref=https%3A%2F%2Fatgamipost.web.app%2F\u0026juh=f2518133475ba0d79112040b35963cf5\u0026cs=8c22c05254bc141cdb1e97b31428ea34\u0026ex=1779262868245\u0026v=81c5b8ec\u0026pi=false\u0026t=1779262268"}},"response":{"raw":"HTTP/2 200 OK\r\naccept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List\r\ncache-control: no-store\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 2\r\netag: W/\"2-vyGp6PvFo4RvsFtPoIWeCReyIC8\"\r\ndate: Wed, 20 May 2026 07:31:08 GMT\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-09T22:47:45.11839Z","times_seen":758080,"resource_available":true,"data":null}},"time_used":445,"timings":{"blocked":77,"dns":1,"connect":34,"send":0,"wait":289,"receive":1,"ssl":39},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}