{"report_id":"6f37c44f-fb9e-44e5-a474-5cd7fe32e025","version":6,"status":"done","tags":["societe_generale","financial","phishing"],"date":"2026-05-09T19:01:42Z","url":{"schema":"http","addr":"momvcm.s3-website.eu-west-3.amazonaws.com/","fqdn":"momvcm.s3-website.eu-west-3.amazonaws.com","domain":"momvcm.s3-website.eu-west-3.amazonaws.com","tld":"s3-website.eu-west-3.amazonaws.com"},"ip":{"addr":"3.5.205.242","port":0,"asn":16509,"as":"AMAZON-02","country":"France","country_code":"FR"},"final":{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/login.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"title":"SG | Connexion","dom":{"size":301178,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (44228)","md5":"d18e7d1e0dd06b6967b16b3986bdd53a","sha1":"7fb2ce22eafeef24a8a859237b48fb1073836fb4","sha256":"c678db50faef46d76ee9a0fdc1fa0caeb2d1d3c45c8907896bee97909d98cd5d","sha512":"1d7a5fe9aa1027a84a27247e169d021035107248611f40a3b86ab25446d1babe2f51e3b53005b2dce8c75c0679fd4c85615d2dda795441ccf952b815e20ee23c","ssdeep":"768:QJbFU+E7NDzwCdDjYO6I+ImBLsNWpuN1Ye8CMmCdP9o5tNLbYrgBpPEb:0x8Pq","tlshash":"c6548523f3f02264882484809aa7b3bd3d7d582573819e75ca45bf7e2788ce76f34659","dom_hash":"domhashf79e22e65d83076279dadb5145d5d238","first_seen":"2026-05-09T19:01:48.692018Z","last_seen":"2026-05-09T19:01:48.692018Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"momvcm.s3-website.eu-west-3.amazonaws.com/","fqdn":"momvcm.s3-website.eu-west-3.amazonaws.com","domain":"momvcm.s3-website.eu-west-3.amazonaws.com","tld":"s3-website.eu-west-3.amazonaws.com"},"ip":{"addr":"3.5.205.242","port":0,"asn":16509,"as":"AMAZON-02","country":"France","country_code":"FR"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-13T19:01:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-09","alert":"Sinkholed","trigger":"momvcm.s3-website.eu-west-3.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]},"summary":[{"fqdn":"xdxhdf.uber.space","ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2015-03-11","domain_rank":0,"first_seen":"2026-05-09T19:01:43.591385Z","last_seen":"2026-05-09T19:01:43.591385Z","alert_count":35,"request_count":35,"received_data":1080362,"sent_data":19007,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-05-03T22:34:13.116124Z","alert_count":0,"request_count":2,"received_data":253950,"sent_data":1023,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"momvcm.s3-website.eu-west-3.amazonaws.com","ip":{"addr":"3.5.205.0","port":80,"asn":16509,"as":"AMAZON-02","country":"France","country_code":"FR"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2026-05-09T19:01:43.589526Z","last_seen":"2026-05-09T19:01:43.589526Z","alert_count":3,"request_count":3,"received_data":2740,"sent_data":1343,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"http","addr":"momvcm.s3-website.eu-west-3.amazonaws.com/","fqdn":"momvcm.s3-website.eu-west-3.amazonaws.com","domain":"momvcm.s3-website.eu-west-3.amazonaws.com","tld":"s3-website.eu-west-3.amazonaws.com"},"ip":{"addr":"3.5.205.0","port":80,"asn":16509,"as":"AMAZON-02","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":true,"md5":"e02e07e19b7a4badcf267f09e9a85edc","sha1":"73a630b71868b465afeacc41ad80d36f6469774e","sha256":"b67d49cb2ec020f9ab9b281d1a9c23fbf86fcefc57f890c7fff296f3933af30c","sha512":"1fe203d9a63fed7f682dbfaa59f183218c1e16da43aab5ccc014a4c453b560b4935e67aae235dbc077ee78aee499be7d93f7872c3220b4e3fc0eb998f52e6318","ssdeep":"","tlshash":"37c09b4630a2185d5b73c057559b684c3123119f494e4d18781e95450f1537d22ef6e6","size":149,"data":"","first_seen":"2026-05-09T19:01:48.732367Z","last_seen":"2026-05-09T19:01:48.732367Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/cdns/m.js","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"24992f1ed62baf9393609f3c6c2ad20e","sha1":"34716cf70f7f7a9cd072e7796c34ce987f85d18c","sha256":"a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8","sha512":"dd181bfff8972676cdcd068a59eed0e61bdd04214c4f49216fc783b8b58ab8414eb0d06c1be03f71f982502000f848d4c0ebc455eb78bce2737dff39c5f1cd91","ssdeep":"384:suPmGzmECrshSSQCyF8jKQze/he/UilGA2Al:BO9EQ8jK78Rl","tlshash":"b5a24f4929f32262566372bd0bef4009b7b68613149eed00bd4d63819f01a7897f7fe9","size":23176,"data":"","first_seen":"2023-03-07T01:19:34Z","last_seen":"2026-08-19T09:23:00.676529Z","times_seen":4253,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/cdns/jq.js","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"1150e561f02aaa2a237a4f200face65d","sha1":"6afaec62e997d0a42356c71521ef0d157b506757","sha256":"9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953","sha512":"9ceef080752858f60608dae2c86cdc1703d217e6cf0ce47e36fb4e632db031c5a4ae708d3ca05c144914f345c8375e145636b419d9df7fd126c9dc8b94e2fb99","ssdeep":"6144:VpkhNVlJ+TC1lFhTzeKpTcYmD2zK8U1Js3Px+WK+N7TFyygRWL/IaLgeNTIPfgy1:kjTcYmD4I4Px+WK+N7TFyjeTiPflAqqi","tlshash":"0554b4d9f78d112e423231aaad2e12cdb77cd171560458aefd4d497c24a083d83baf7a","size":293671,"data":"","first_seen":"2023-03-12T23:28:44Z","last_seen":"2026-08-18T19:18:12.016244Z","times_seen":1504,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/login.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"9a3468e247f7f41e03a2d65290706b47","sha1":"8874144278558f5cdead4d40555f0907f33edb99","sha256":"c33990c0a3c351abb83bb2accd5f87cd22ba079e464dc27b8d1081a291d91114","sha512":"02ba969c7ba740c876437543341a1523c2c7cd3cd62455957a5d7032e2f43d7a3994d9dc79a9e3a2e9deb7ca87a78e50ad232b5f85499f238428f1128177380c","ssdeep":"","tlshash":"0c41bb99f0f60786667b04780e8f4224aaa4554f1608cc0cbc6d6ed06f9de05daa6298","size":1982,"data":"","first_seen":"2026-05-09T19:01:48.734015Z","last_seen":"2026-05-09T19:01:48.734015Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/cdns/m.js","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/cdns/m.js HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: W/\"5a88-63006618f9240\"\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23176,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"24992f1ed62baf9393609f3c6c2ad20e","sha1":"34716cf70f7f7a9cd072e7796c34ce987f85d18c","sha256":"a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8","sha512":"dd181bfff8972676cdcd068a59eed0e61bdd04214c4f49216fc783b8b58ab8414eb0d06c1be03f71f982502000f848d4c0ebc455eb78bce2737dff39c5f1cd91","ssdeep":"384:suPmGzmECrshSSQCyF8jKQze/he/UilGA2Al:BO9EQ8jK78Rl","tlshash":"b5a24f4929f32262566372bd0bef4009b7b68613149eed00bd4d63819f01a7897f7fe9","first_seen":"2023-03-07T01:19:34Z","last_seen":"2026-08-19T09:23:00.676529Z","times_seen":4253,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:28.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:28 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:36.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.413Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.3.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18765\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"63e2af34-494d\"\r\nlast-modified: Tue, 07 Feb 2023 20:06:12 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 132470\r\nexpires: Thu, 29 Apr 2027 19:01:25 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aK%2Fy5sIJy3TPhDNNiDN9CYpNZbO1Cn3vhen9dB1SmZJu7JsxwLgAWXKMX%2FfV5kKUbKoFkjtxIpVRb%2FuhUaniW5oWtTySs3PGFM0EiAHP6DtPXTlf8lcXQbUK7SOiYQKItStK7ssD\"}]}\r\ncf-ray: 9f92f3e1ea0756c5-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102025,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"2fd961571c270c2d63b165a97488fe95","sha1":"8922f78fc464d96eafb41f27916e97b9a12f5e37","sha256":"ff8510712984ac3ccf08c022b8e8963d556c34ddacdd963f36c99735c8f42057","sha512":"4b396bc56525a5fbb343ea5c502a2cc5c825411340abf0d98d5b02d25138d31b000ec7de428132a44f9e9f070e8868e4fdb4ae1862871328d2a10d73562b1a9d","ssdeep":"1536:hwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuZprfZCl:d709gMGFiyPGuZpfZCl","tlshash":"2fa3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-04-05T16:51:19Z","last_seen":"2026-08-19T03:15:27.241102Z","times_seen":4831,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":14,"dns":0,"connect":1,"send":0,"wait":11,"receive":1,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/fetch.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:29.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/fetch.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"update=1"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:29 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-20T07:03:35.127823Z","times_seen":119847,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:30.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:30 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/fetch.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:33.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/fetch.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"update=1"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-20T07:03:35.127823Z","times_seen":119847,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:34.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:34 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:26.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:26 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:29.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:29 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/fetch.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:31.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/fetch.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"update=1"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:31 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-20T07:03:35.127823Z","times_seen":119847,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"http","addr":"momvcm.s3-website.eu-west-3.amazonaws.com/favicon.ico","fqdn":"momvcm.s3-website.eu-west-3.amazonaws.com","domain":"momvcm.s3-website.eu-west-3.amazonaws.com","tld":"s3-website.eu-west-3.amazonaws.com"},"ip":{"addr":"3.5.205.0","port":80,"asn":16509,"as":"AMAZON-02","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://momvcm.s3-website.eu-west-3.amazonaws.com/","date":"2026-05-09T19:01:22.769Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: momvcm.s3-website.eu-west-3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://momvcm.s3-website.eu-west-3.amazonaws.com/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nx-amz-request-id: W5F44G52XXW62WHC\r\nx-amz-id-2: IZZAtqMIje1vuf9cJmGxpm+1Gh3GM3zVACxjA9mCeWGpKH9u7Zk4USP82TDYyU0+msOVonkJlruHvwpkryh1n2wTnczye9po\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 366\r\nDate: Sat, 09 May 2026 19:01:21 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":366,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"d3cdeb9e581cade2b0c5d05fcc4c8357","sha1":"f1e610e92e5011a431eeb7e747e65ec1905f02f2","sha256":"b3d0f763c266ff9e3ea485260c28a98f2cb34130e2f75c61704eb4b18e84c927","sha512":"e197d901658e56e005b8132822230d7b1a399fd2ddcb2324eab8c942bf6ec094a638377c16aea13e21dc53652ceb26003725a0c88de152d174a7c1584834bf07","ssdeep":"","tlshash":"57e0c01e040ac709a500501cecd93b415a57137ae6ba47372442c2ca748b1f88d5358e","first_seen":"2026-05-09T19:01:48.697797Z","last_seen":"2026-05-09T19:01:48.697797Z","times_seen":1,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-09","alert":"Sinkholed","trigger":"momvcm.s3-website.eu-west-3.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-09T19:01:24.745Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://momvcm.s3-website.eu-west-3.amazonaws.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nlocation: fr/login.php\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":301565,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":520,"timings":{"blocked":158,"dns":94,"connect":23,"send":0,"wait":204,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/login.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-09T19:01:25.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/login.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: http://momvcm.s3-website.eu-west-3.amazonaws.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":301565,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (44228), with CRLF line terminators","md5":"1245896b6424a5263af9c990ef3ecc48","sha1":"1c7080497b9c657ce035161990fd056ea99a6cb3","sha256":"e1ca087467f0b14b7a2ca29e2ece130fd93becac50eac2ead5bf4a1259f69130","sha512":"203f6e11784ffe235eb9966ab6c06171e8265671f59220da16516c3f47c3b8f8f319bbc770b13ac8f17d50bf2d755805cb78033659bb5d6b983ffe1c939071bb","ssdeep":"768:CCkWFFNDzwCdDwYO6I+ImBLqNNpuY1Ye8CMmCdPyojOBtZYVg2jA:PQ","tlshash":"aa548523f3f02264882484809aa7b3bd7d3d582573819e75ca45bf7e2788ce76f34659","first_seen":"2026-05-09T19:01:48.707051Z","last_seen":"2026-05-09T19:01:48.707051Z","times_seen":1,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/reg.woff","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.537Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/reg.woff HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/res/main.css\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: application/font-woff\r\ncontent-length: 75420\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: \"1269c-63006618f9240\"\r\naccept-ranges: bytes\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75420,"size_decoded":0,"mime_type":"application/font-woff","magic":"Web Open Font Format, CFF, length 75420, version 0.0","md5":"52f5045b30343cd0e0a5acbd215a50e9","sha1":"dc37d3ef1b5939ad6a5dfae601ae183c503095f2","sha256":"f679efce1ea9cbed26a573aa8c8db1d01fe51abe4fcc2a77d18ab7bcb03e0bb1","sha512":"81ed5a9faa47baadf62ba9f892c7d0a741419831aee61a9c4ff54d47db46e9bd01c4b57e2e4a2c2d23635280f0fb8e3136c121f6372701209f7acef663d6261a","ssdeep":"1536:z2+NgW/0fZ9xWpsJrF2F5w1tUcZ4AasqHjBC5mRCWYCS6Fh:z2fIpsQa/VZ4AasqE5mg3CjL","tlshash":"b47302204a11c1a4d41726fc5b2fe13b4b74a5e04681f5760c9fea7693ccff81a6e98a","first_seen":"2023-04-06T19:55:51Z","last_seen":"2026-07-22T13:49:32.592998Z","times_seen":896,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/icon.png","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/icon.png HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 249\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: \"f9-63006618f9240\"\r\naccept-ranges: bytes\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":249,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 52, 8-bit/color RGBA, non-interlaced","md5":"b445389edf08900e6851f6674ea0d519","sha1":"1a5158e20d0edb988243bab3a149320018bef963","sha256":"2a16cbe095c093e858f3a655ebbd237b620b87f88518d37cb0e7bc3c3eccc7d0","sha512":"acc6514ee51601c1e3cef55a0150f3e1ff35152a33e79b4dfefd5bccf62b878010ec3e681e23c23b71dce707d59e648d66be0c5e708f56130257a503dc0f3b13","ssdeep":"","tlshash":"8bd097f4e902cc2cc5c609a7d9a30814fef253e742e01b28d82088b2422f22c6ec5733","first_seen":"2023-10-09T02:43:17Z","last_seen":"2026-07-22T13:49:32.590752Z","times_seen":79,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"http","addr":"momvcm.s3-website.eu-west-3.amazonaws.com/","fqdn":"momvcm.s3-website.eu-west-3.amazonaws.com","domain":"momvcm.s3-website.eu-west-3.amazonaws.com","tld":"s3-website.eu-west-3.amazonaws.com"},"ip":{"addr":"3.5.205.0","port":80,"asn":16509,"as":"AMAZON-02","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-09T19:01:22.525Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: momvcm.s3-website.eu-west-3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: QrLyc414LZsyLwMTUpspnowssSqdUY57KTdfcZauKB8BvxZyk6gmCd0aTgnwbR6dc+5/R3RS/ZMj9xP9stPRVJk80GKV6hKg\r\nx-amz-request-id: W5F8QRKYFCVJ4TMC\r\nDate: Sat, 09 May 2026 19:01:23 GMT\r\nLast-Modified: Fri, 08 May 2026 23:58:57 GMT\r\nETag: \"d9e6fe52dc0ccfbec0f5d1ac51b60cc3\"\r\nContent-Type: text/html\r\nContent-Length: 1731\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1731,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"d9e6fe52dc0ccfbec0f5d1ac51b60cc3","sha1":"ffe818423cfc0e2350e2573817c1f7d546544553","sha256":"7be6885e565241038b582ec65f39ac8a6199231d6621d167d8c75318aea1cb81","sha512":"072707af6dad27cb6896ecc554dbb4d0c5009536a52ef3945384b5c38aa87051b6cd3f4678c199992c4fe63d4dcc4894d47512feb5ae73c265d191514103c792","ssdeep":"","tlshash":"db3101563c4124098533d3346bf29248e9a3517bd7070a953edd225b4fb42788ac3fc8","first_seen":"2026-05-09T19:01:48.709924Z","last_seen":"2026-05-09T19:01:48.709924Z","times_seen":1,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":37,"dns":1,"connect":37,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-09","alert":"Sinkholed","trigger":"momvcm.s3-website.eu-west-3.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:27.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/fetch.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:35.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/fetch.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"update=1"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-20T07:03:35.127823Z","times_seen":119847,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/fetch.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:39.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/fetch.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"update=1"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:39 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-20T07:03:35.127823Z","times_seen":119847,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"momvcm.s3-website.eu-west-3.amazonaws.com/","fqdn":"momvcm.s3-website.eu-west-3.amazonaws.com","domain":"momvcm.s3-website.eu-west-3.amazonaws.com","tld":"s3-website.eu-west-3.amazonaws.com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-09T19:01:19.341Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: momvcm.s3-website.eu-west-3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":127,"timings":{"blocked":0,"dns":94,"connect":31,"send":0,"wait":0,"receive":0,"ssl":-1},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-09","alert":"Sinkholed","trigger":"momvcm.s3-website.eu-west-3.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/main.css","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.420Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/main.css HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: W/\"9c7-63006618f9240\"\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2503,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"0256936b95f8e1dfd16549b1f678ee5f","sha1":"fbd289cf6203d910e03efddc2bd8b0623d18e35d","sha256":"58265dc18ccc757a9d9ad244ec994b65804f3bb77d12aaa6e546085e180dfde8","sha512":"91da61a7aa2fc60097df5c862cf33c2bced90cf400fb3bc98579ef37226bf785ad65b02afc7dc3611fbdc2b5cabcb60dee152164c07d076b3d37f24efd37812b","ssdeep":"","tlshash":"e451569ed645210f33739e60bbb25f462e9a0017ce4b42b9fcfc5128d58122a4730e9c","first_seen":"2023-10-09T06:35:03Z","last_seen":"2026-05-09T19:01:48.710969Z","times_seen":2,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/cdns/jq.js","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.437Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/cdns/jq.js HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: application/javascript\r\nvary: Accept-Encoding\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: W/\"47b27-63006618f9240\"\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":293671,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"1150e561f02aaa2a237a4f200face65d","sha1":"6afaec62e997d0a42356c71521ef0d157b506757","sha256":"9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953","sha512":"9ceef080752858f60608dae2c86cdc1703d217e6cf0ce47e36fb4e632db031c5a4ae708d3ca05c144914f345c8375e145636b419d9df7fd126c9dc8b94e2fb99","ssdeep":"6144:VpkhNVlJ+TC1lFhTzeKpTcYmD2zK8U1Js3Px+WK+N7TFyygRWL/IaLgeNTIPfgy1:kjTcYmD4I4Px+WK+N7TFyjeTiPflAqqi","tlshash":"0554b4d9f78d112e423231aaad2e12cdb77cd171560458aefd4d497c24a083d83baf7a","first_seen":"2023-03-12T23:28:44Z","last_seen":"2026-08-18T19:18:12.016244Z","times_seen":1504,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/fetch.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:37.687Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/fetch.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"update=1"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:37 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-20T07:03:35.127823Z","times_seen":119847,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:38.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:38 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/topmenu.png","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.422Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/topmenu.png HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 2760\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: \"ac8-63006618f9240\"\r\naccept-ranges: bytes\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2760,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 296 x 27, 8-bit/color RGBA, non-interlaced","md5":"414e9188f14450fb196d9bcb142d96cb","sha1":"09e1969f44a4f92cf648ce6e0dee6397588bc392","sha256":"fe5fc12166bd1daba8eb11acc0846c43101f54f761178abcf1962ed1f0fcb1b1","sha512":"85c86222ed284187cc99e3158e9c38354390debe8a8a0815991bd7ccafe48327ca0891e1d61c0bbc697b4e99fc93f57235f728aba8a90f6c391554cc7b61b62d","ssdeep":"","tlshash":"325118f2733d8868ab9c0262222e3a69ff72451a151cf22df85f5d49072cd0c62506f3","first_seen":"2023-10-09T02:43:17Z","last_seen":"2026-07-22T13:49:32.589619Z","times_seen":79,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:33.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:35.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:35 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:31.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:31 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/bottom-footer.png","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.431Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/bottom-footer.png HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 25556\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: \"63d4-63006618f9240\"\r\naccept-ranges: bytes\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25556,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 558 x 604, 8-bit/color RGBA, non-interlaced","md5":"2881f21de2743776c1de7ee3b91573c2","sha1":"2713ca562679570cf715faf44f42d51bb580416b","sha256":"53a9cfe9a7d0952081f50d76737b34913c5e9d61d3720b961849d2df88e2f8e9","sha512":"eb49352643c76a0445a98243f11f2bc9d26a258a30f30d778a217c41030fb82d4cc192165afe3c32e88d5a29fc3cc6cdbe45955d156b3f6e9e67ec3f433687c6","ssdeep":"384:KpIsVjduGb5GDNyFns6YVArKpy1jaUS7Tk3LBQ7E2wqcsNQY5bt/T72hKm:KpIKUg5Y6YKqfUss9Q7JncXOxEd","tlshash":"7fb29e09739b54f09cfc5ae601d994fc26e1da0e5f2a6f71f04e8ae64b560ce33d2650","first_seen":"2023-10-09T02:43:17Z","last_seen":"2026-07-22T13:49:32.592386Z","times_seen":79,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/rememberme.png","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.430Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/rememberme.png HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 3678\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: \"e5e-63006618f9240\"\r\naccept-ranges: bytes\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3678,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 295 x 43, 8-bit/color RGBA, non-interlaced","md5":"de8c70896a3b22598244e387ee161cc5","sha1":"440044774644f0815be7eacb3590c546ab793a82","sha256":"fdd6f037f4ef4900ad0eecd067e0af0c68349fd2c3b6925c14009a48edfb2f9d","sha512":"9eefc70fef797e1c82f84318d7297ce5625612c4e1831b3e51e428f8b091d34a6888235cefdf23930655b5dd762d6781176dfaa7d29c3ee524113598acd77235","ssdeep":"","tlshash":"c9715ae1a3dd8610e0fc3e930bd040341aac64d2f36e8aad3a6011844b2fb093c95383","first_seen":"2023-10-09T02:43:17Z","last_seen":"2026-07-22T13:49:32.587195Z","times_seen":79,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/webfonts/fa-solid-900.woff2","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.572Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 14 Mar 2026 00:38:49 GMT","end":"Fri, 12 Jun 2026 01:38:45 GMT"},"fingerprint":{"sha1":"7A:4A:F6:D6:63:62:70:CA:51:C5:5A:06:41:17:71:BF:9D:2C:C9:42","sha256":"7F:F5:F5:FE:73:1F:E7:AF:1A:82:5B:59:EE:E8:E9:65:D6:87:68:61:8C:11:1E:94:4A:9A:C4:14:BD:4B:04:BA"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.3.0/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cdnjs.cloudflare.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: application/octet-stream; charset=utf-8\r\ncontent-length: 149908\r\nserver: cloudflare\r\npriority: u=4,i=?0\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\netag: \"63e2af35-24994\"\r\nlast-modified: Tue, 07 Feb 2023 20:06:13 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 318318\r\nexpires: Thu, 29 Apr 2027 19:01:25 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k1jlPbdVLytV4lhq7xhnun77v6ziRxz%2BZlGXSKhdWeTxMts%2BfsUPbieHoywCkDW2wiQ0GzYxd2IVCpdtzZcY1vnG2ou2Z9wKXylAqfk1GrLcWaX2NVsTqcAO8q5KTfFWphVQ67i1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\ncf-ray: 9f92f3e2f9cb32fa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":149908,"size_decoded":0,"mime_type":"application/octet-stream; charset=utf-8","magic":"Web Open Font Format (Version 2), TrueType, length 149908, version 771.256","md5":"44f8148f80e6c3d60fa6425b0cbb862a","sha1":"ec2f4e5f311462dce67b8f354e5bb9a68c12cf58","sha256":"e2c5cf547e2e8d74a17d05c5ad9f1f593ca526452e228124294fa983b908ff82","sha512":"07978f5827f0d5e9191b6970f0a01d10b88e33524c4aa3973d527ace295ee356f907c0374a430785eaabdd1ac06811c841b3da704066044f4d66fa4cc755ec8d","ssdeep":"3072:1q8xfiSXJLOvVpYQgUGUn9bymvMalSSb8S9glCb2XzMZm:A83ZLMVpYKrtPvQRSuzv","tlshash":"b9e312560a90854e7ad8c661360fef0fc28f33ea6ffff2a5e0c1fa8655dc94a2594450","first_seen":"2023-04-07T23:49:37Z","last_seen":"2026-08-20T06:01:55.941987Z","times_seen":3453,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":21,"dns":1,"connect":0,"send":0,"wait":7,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:32.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:32 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/reset.png","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/reset.png HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 504\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: \"1f8-63006618f9240\"\r\naccept-ranges: bytes\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 30 x 31, 8-bit/color RGBA, non-interlaced","md5":"a7d519dcf3e125661a85d0598005542a","sha1":"8f0f9873b87eaf6d9e162407e2742d92aeb58bde","sha256":"38c0ed3648a4fe19906d33e472cde174a5db4fe3640d56516238e08db16f65fc","sha512":"ab1035bb482c48bfab1fd554fb22420bfe50b9dbb9971566df4edc991e388de7feda681c41db0485e57dffc232077fdccc49edfccdacbfa5ab60c28a92cf21da","ssdeep":"","tlshash":"99f005e7755899b8c3173f3a2ca31450db7e6754d051b11b2e549112406d85c99fd283","first_seen":"2023-10-09T02:43:17Z","last_seen":"2026-07-22T13:49:32.594545Z","times_seen":79,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/fetch.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:27.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/fetch.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"update=1"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-20T07:03:35.127823Z","times_seen":119847,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:37.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:37 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/panel/update_statu.php","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:39.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"POST /panel/update_statu.php HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 24\r\nOrigin: https://xdxhdf.uber.space\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":24,"data":"update=1\u0026ip=91.90.42.154"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:39 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: nginx\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T07:30:34.811759Z","times_seen":17986652,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/bottom-footer-pc.png","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/bottom-footer-pc.png HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: image/png\r\ncontent-length: 24560\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: \"5ff0-63006618f9240\"\r\naccept-ranges: bytes\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24560,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1897 x 268, 8-bit/color RGBA, non-interlaced","md5":"84e2c4bf2cd5411190b55934ede547da","sha1":"55c796cf91efc1815cc0e71e9a81084ccb0cbf5e","sha256":"9c3429f5191e63dd03f937003c31cab739027e3de2ea6a195d874b33ba18b192","sha512":"675ca6ef99b77dc90eed5d164bb05409fbb0884306621b5ac2511d6c7cb56373df7e5575f2e2a884e6afa3774c8c2bcf1c728d6007ed88968695c79cd23dee6e","ssdeep":"384:2JtZPjHxmQyK7Mvq6gY4fSperLDlo7NLIowzO7Af+zI0hgdPG3uVpR:2ll57MkY4fdHgpNQe1h7gn","tlshash":"d2b2ad6239c9db60c0c14d3c7c701edee52119b1d088ece26daacd6e0a52a71e9fd9d9","first_seen":"2023-10-09T02:43:17Z","last_seen":"2026-07-22T13:49:32.588052Z","times_seen":79,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/jihanaid.css","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.417Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/jihanaid.css HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: text/css\r\nvary: Accept-Encoding\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: W/\"2032-63006618f9240\"\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8242,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, ASCII text, with CRLF line terminators","md5":"9a18104c941db52b5f8ff241583b0be0","sha1":"ef84dbc6363b4f68a78348871867f508b6920b18","sha256":"d70c5074c336ddcb5ee9dbb94ae2c4ae696eb75b51e094912d189d33b96c9598","sha512":"66ec29a51ef8729175f40fdb2a63ea97d6705887fa2ec8c872f09d4bef31d46b04e3102a2bc597cb1a035d59485ec7ea192a9c318f167df921b4d49fc5ec845c","ssdeep":"192:sqfB0o+WYWMoDhTVHBBAxiT86wkusaXdSMyJmc4Z+XmYXoSafYx4fID9N+Fi/2dO:RGRWMYTvCXdSMyJmc4Z+XmYXoSafYx4W","tlshash":"e202306358563109212bc13b91e7fd86ecaf1417c60bb3ebf8a07524cedf05f0a20a58","first_seen":"2026-05-09T19:01:48.729782Z","last_seen":"2026-08-10T19:03:35.123645Z","times_seen":3,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"xdxhdf.uber.space/fr/res/logo.svg","fqdn":"xdxhdf.uber.space","domain":"xdxhdf.uber.space","tld":"uber.space"},"ip":{"addr":"185.26.156.20","port":443,"asn":58010,"as":"uvensys GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://xdxhdf.uber.space/fr/login.php","date":"2026-05-09T19:01:25.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"xdxhdf.uber.space","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 07 May 2026 01:15:19 GMT","end":"Wed, 05 Aug 2026 01:15:18 GMT"},"fingerprint":{"sha1":"13:FE:1A:88:ED:6A:D4:0B:58:75:08:B8:03:CE:AC:A4:63:D3:87:D8","sha256":"86:EF:58:D6:FE:94:2A:6D:DC:48:1F:9D:5C:0A:0A:44:3F:AD:BC:DE:C6:CA:E2:6E:03:24:17:17:48:F0:7E:8F"}}},"request":{"raw":"GET /fr/res/logo.svg HTTP/1.1\r\nHost: xdxhdf.uber.space\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://xdxhdf.uber.space/fr/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 09 May 2026 19:01:25 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nserver: nginx\r\nlast-modified: Tue, 11 Mar 2025 00:43:45 GMT\r\netag: W/\"eac-63006618f9240\"\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3756,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f7056ffda7cad3d30586ceb5b580469d","sha1":"2967309e3f3e30d847539920a85609e143c849f9","sha256":"3daf7b393585bc449ab1c837b8cbf689a747094923f906691d09e01979788c68","sha512":"a5a0613c1cbea0f5d479fd178d68957cd816241d4654f4b6bc1297d91d1371b79db8cc10243a0755684d71b279ee8c410e844127a9f4a4732ea38c68d6f11c93","ssdeep":"","tlshash":"8d71aa174388a78e997d038c5aad1054b9a1d9d7d070d2c1feaf0413db2c4e1b96f6f9","first_seen":"2023-10-09T02:43:17Z","last_seen":"2026-05-09T19:01:48.73097Z","times_seen":3,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Societe Generale","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Societe Generale phishing","tags":["societe_generale","financial","phishing"],"meta":null}]}}]}