{"report_id":"73cccf8e-00f9-447d-8fd5-647f67d477cc","version":6,"status":"done","tags":["suspicious","phishing","mamba","aitm"],"date":"2025-08-13T10:23:44Z","url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"title":"Aave Sport | Elite Athletic Training \u0026 Sports Excellence"},"submit":{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-17T10:23:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]},"summary":[{"fqdn":"app-aave-gho.eu.com","ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-08-12","domain_rank":0,"first_seen":"2025-08-13T10:23:44.531624Z","last_seen":"2025-08-13T10:23:44.531624Z","alert_count":10,"request_count":8,"received_data":283731,"sent_data":6048,"comment":"","tags":null,"fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"d08bb5fc22b2baf3f06088ecf723391b","sha1":"2db84f3f9c6baef7865e190174fcad05f8e73c07","sha256":"74625831136e57e198c7763bb81f656f3e3aa6685c3cc693fe064582f2d108f9","sha512":"ef163a487869c9d7fddf58a8d877a2650989bb727caca371a49fc456420a4bc6edd31148cc13043370dae7620e3cd4546a0557ad1ffa573883b5cc83121dac00","ssdeep":"","tlshash":"cd90028661156220405610e4584e81440212210027908628511d06d85715c6622638b5","size":44,"data":"","first_seen":"2024-12-02T18:53:13.736335Z","last_seen":"2026-08-13T04:56:43.590525Z","times_seen":41196,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"1878cc1b9617523b3e1ceed41dd9e2ba","sha1":"9f9c7b5ee7719b9b1e7a353d011ea000c05f8a5b","sha256":"59878523262c3ff3fc8e071b0ec34fb395b8a728ebfabc2488e2e6cb4042dcca","sha512":"a229bedea6ab746be227e9f6ab908c6b958196932105e5cd37c77b6a89e4b3f8d0240b3b145c42be11a0b29fa5a06e6bd28d7beee6f02899b146ebb5a01d7174","ssdeep":"","tlshash":"e1413375b0b6b43816b30017313f9645b3b753647ca9f4c1818ed999b9bcc4a0b2ebe8","size":1931,"data":"","first_seen":"2025-05-07T20:25:43.584111Z","last_seen":"2026-04-29T16:33:03.647908Z","times_seen":1256,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","size":1239,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-13T11:46:55.492069Z","times_seen":419023,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"70e38204b789423e6b1758221120ecf1","sha1":"fee639b514717d357361dbc100947b3f3a33e999","sha256":"d4ab191322f27f3f3329ee48d3152abbfd38113b8e4bc52df0ffdfa624eb2cba","sha512":"05fadfe8e6dae279efd0c43412f5b1c91db3f6533eba31fd43527f2f1e6c54443bdf1a4476d8b9daae375c8f408472a307c316ce0bca88fbb5ffe59452b406c8","ssdeep":"","tlshash":"3a41be2e41b010b151fb72aac39f67817236404b7141d9453e6ccf692fa5ef649e0bda","size":2031,"data":"","first_seen":"2025-08-12T16:25:39.339174Z","last_seen":"2025-08-13T10:23:46.856575Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"app-aave-gho.eu.com/favicon.ico","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","date":"2025-08-13T10:23:22.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ncontent-type: text/html\r\ncache-control: private, no-cache, max-age=0\r\npragma: no-cache\r\ndate: Wed, 13 Aug 2025 10:23:22 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VrAIM1NT7Gl%2FA7etKNlAYX9q3qFcrH8C%2BFX99IvffZS%2F0L%2FfGJaC2vhRt5fSvL3ACACpRrVohueLom50y4pCNXNe0mn5nQ5qnCsF3gNRYYCt\"}]}\r\ncontent-encoding: br\r\ncf-ray: 96e77f26dba556c0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1249,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"f58515dfe987f7e027c8a71bbc884621","sha1":"bec6aebf5940ea88fbbff5748d539453d49fa284","sha256":"679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43","sha512":"f085346a38318f7935d76909db0367862924cc9b0d96256f7ff4e8999c041e610bbcde8ca56c92673bde0991c85e9c9d9b6726abd91d0c3177462c80d4a99140","ssdeep":"","tlshash":"8b21653ec1c1520ae0271164fb81f3a86629821191970f703b8eb176f6cd0bb52a36c8","first_seen":"2024-02-10T12:39:22Z","last_seen":"2026-08-13T04:52:57.802873Z","times_seen":43394,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-13T10:23:21.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"GET /home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 13 Aug 2025 10:23:21 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: no-store\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=urSvTy4i%2F2MLDXvmNJ%2BdFR82TrNoKNsfQro9Y5kGlZWiL3H6sk%2Fa1gMQfSEku%2FrHqiMuS4PHTvDgrEx1MtxTiXMHyIcMSlkfE2aSP6NCSlGb\"}]}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nset-cookie: _cid=8c5fabb318281197825f7ee2af54e131; Max-Age=60; Expires=Wed, 13 Aug 2025 10:24:21 GMT\r\ncf-ray: 96e77f1fee4b5690-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2944,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (2675)","md5":"07a031f7bbfd85cbfd1e26aee11cab4d","sha1":"f6ff1f8f0014316eecef296301e9ff4d72cae7ba","sha256":"da2fa8c9b8d324d1ac9794956619f02985ab1dd01feac70d2fb329d7f3c17aef","sha512":"0e27960d79720e352f9f5a0df04a679c0f36956df12013982e03f9aef70acd84175d952b6deb5c4423c1207300be8f63cf48b8b583fe365a21282e9360ec45ca","ssdeep":"","tlshash":"a95109c3fa962f95d1245b03b7c8659b02342dca34536c08e7d210ed1e65fa68ad70dc","first_seen":"2025-05-07T20:25:43.468773Z","last_seen":"2026-04-29T16:33:03.623836Z","times_seen":1247,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":23,"dns":6,"connect":1,"send":0,"wait":205,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/files/img/logo.png","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","date":"2025-08-13T10:23:21.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"GET /files/img/logo.png HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 Aug 2025 10:23:22 GMT\r\ncontent-type: text/html\r\ncache-control: private, no-cache, max-age=0\r\npragma: no-cache\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RqxtTQrENGvU%2BmJPWDBUwenqP%2BGM5NtYAPp6UcKHnMnESx9rXbPv%2FxSdme93jNenEHJXi%2BgC9z7q5W73zd5o31ohp0RX8nvQQJIKYHOLsYva\"}]}\r\nvary: Accept-Encoding\r\ncf-cache-status: BYPASS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 96e77f224a6d5690-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1249,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"f58515dfe987f7e027c8a71bbc884621","sha1":"bec6aebf5940ea88fbbff5748d539453d49fa284","sha256":"679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43","sha512":"f085346a38318f7935d76909db0367862924cc9b0d96256f7ff4e8999c041e610bbcde8ca56c92673bde0991c85e9c9d9b6726abd91d0c3177462c80d4a99140","ssdeep":"","tlshash":"8b21653ec1c1520ae0271164fb81f3a86629821191970f703b8eb176f6cd0bb52a36c8","first_seen":"2024-02-10T12:39:22Z","last_seen":"2026-08-13T04:52:57.802873Z","times_seen":43394,"resource_available":true,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/favicon.ico","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","date":"2025-08-13T10:23:22.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Wed, 13 Aug 2025 10:23:22 GMT\r\ncontent-type: text/html\r\ncache-control: private, no-cache, max-age=0\r\npragma: no-cache\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=enM2xnteF%2BxElmYGcEfJ0IzFvlTHTgN0qDrMy6LU%2FKE6F9nKJu%2BRCH3p%2F%2FIHOH7AQ9pIQ1CTwY%2FMzXkrAzkhbQi%2FTOVZaJdxN7XLpIqJwObK\"}]}\r\nvary: Accept-Encoding\r\ncf-cache-status: BYPASS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 96e77f22eb425690-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1249,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"f58515dfe987f7e027c8a71bbc884621","sha1":"bec6aebf5940ea88fbbff5748d539453d49fa284","sha256":"679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43","sha512":"f085346a38318f7935d76909db0367862924cc9b0d96256f7ff4e8999c041e610bbcde8ca56c92673bde0991c85e9c9d9b6726abd91d0c3177462c80d4a99140","ssdeep":"","tlshash":"8b21653ec1c1520ae0271164fb81f3a86629821191970f703b8eb176f6cd0bb52a36c8","first_seen":"2024-02-10T12:39:22Z","last_seen":"2026-08-13T04:52:57.802873Z","times_seen":43394,"resource_available":true,"data":null}},"time_used":112,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-13T10:23:22.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"POST /home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 112421\r\nOrigin: https://app-aave-gho.eu.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE\r\nCookie: _cid=8c5fabb318281197825f7ee2af54e131\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 13 Aug 2025 10:23:22 GMT\r\ncontent-type: text/html;charset=UTF-8\r\ncache-control: no-store\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n5CJDZwQXbulxBRyUI9bJMxDddHr1WHOtO3IAOiMqFyMvewSGF9GZs9CivFKzeUGARhvzclpKuFy6Y19%2B%2FDz2JRmWBaQYxP4buWxOUu2enei\"}]}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 96e77f244d7c5690-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":49097,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (1114)","md5":"3491b6e6dd5232c3ef789c6bb155b3d4","sha1":"3d84b80d044a55ca0f4f2a45569ef709eb8e232b","sha256":"b5088f4d1bef0d71dde9823382282eaf5b754671a5a4c09848ab196f45375627","sha512":"c494fa551f696f2e0df8240e39b036466f42898dac2974efd89071cbdb3831299b70293736c9468b452d1b404f65b77d6155855c537c116a3b904021679222b9","ssdeep":"384:R/J9mVFUOMDihnisj+Djv/GzzzPThTwPrhz06UXaV:R/JQVFUO9JSDqzr+n","tlshash":"0d23983a52f32025a053e1b85ba6135a3779e143d10ecd587aac1748cfc2edd9da379c","first_seen":"2025-08-13T10:23:46.843058Z","last_seen":"2025-08-13T10:23:46.843058Z","times_seen":1,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":0,"dns":0,"connect":0,"send":1,"wait":286,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Anti-debugging code","verdict":"suspicious","severity":"low","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/assets/sport-mission.jpeg?prompt=Elite%20sports%20training%20center%2C%20professional%20athletes%2C%20coaches%2C%20Olympic%20training%2C%20fitness%20equipment%2C%20championship%20preparation%2C%20sports%20academy","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","date":"2025-08-13T10:23:22.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"GET /home/assets/sport-mission.jpeg?prompt=Elite%20sports%20training%20center%2C%20professional%20athletes%2C%20coaches%2C%20Olympic%20training%2C%20fitness%20equipment%2C%20championship%20preparation%2C%20sports%20academy HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE\r\nCookie: _cid=8c5fabb318281197825f7ee2af54e131\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 19 Aug 2025 21:43:42 GMT\r\netag: \"12c63-689412f4-140255;;;\"\r\nlast-modified: Thu, 07 Aug 2025 02:44:04 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 76899\r\naccept-ranges: bytes\r\ndate: Wed, 13 Aug 2025 10:23:22 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\nage: 45580\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bq7ef%2Bs1MtEXQ2RaGZefIFi7%2BdNYvNjPDN8OF4OgB64TZnZLZ7LC%2FiW980GseUn0hROry53jPWcbbnrDvEhPoLEVmQWylLgTxWLHUdWvOhBC\"}]}\r\nvary: accept-encoding\r\ncf-ray: 96e77f264b8d56c0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":76899,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3","md5":"ba9d418c4c5ef6935fa1c8685a458157","sha1":"1e00c1709dfffe5ea77fb07f36ed24a5ffe36fce","sha256":"ea88fbd8d9db51f3f7be3d675ddd1b82560c97467cbcb8cd3f2cf3622de38cf6","sha512":"c0dcc6adc4ca55ae88c5c089d1a6b1e58cc1747befb1ec8d76fd206dc30e12ad6eb96a5eb0bd0862b0d11c5a3d6eb1760c596ee7d56a1eb0ce59dc5921203726","ssdeep":"1536:3Epvz9KsQnL2K/xE9M6ifixgJF6Xzidl252eQoalVEg9OidPje:0pWnL2Ei9M6ifixgJFwWq2ToalOgUidS","tlshash":"0d7312f94cc42d07d66947b21341d04d4bf8af29eaf8454ec72475e3cba4851ab2a2bf","first_seen":"2025-08-12T16:25:39.336354Z","last_seen":"2025-08-13T10:23:46.847107Z","times_seen":2,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","date":"2025-08-13T10:23:22.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-type: application/javascript\r\nexpires: Wed, 13 Aug 2025 11:11:22 GMT\r\ncache-control: public\r\nvary: accept-encoding\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U%2BH84nKxSMSnG1xm0c5I%2FHBcoYBeD%2F4F%2F8ZEHaWWimA9vS09640wYCtKPdSx7A6cXjuI9yW23eL%2B4xtLQJOiaNewSAsa9pOIAD0IU4rOSpZv\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ndate: Wed, 13 Aug 2025 10:23:22 GMT\r\ncf-ray: 96e77f264b8e56c0-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1239,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1238)","md5":"9e8f56e8e1806253ba01a95cfc3d392c","sha1":"a8af90d7482e1e99d03de6bf88fed2315c5dd728","sha256":"2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8","sha512":"63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee","ssdeep":"","tlshash":"6021d5743a18107e226a0133e56f66cee1f23715fd17e440408ad89566e4fe5063fed9","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-13T11:46:55.492069Z","times_seen":419023,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"app-aave-gho.eu.com/home/assets/sport-hero.jpeg?prompt=Epic%20sports%20stadium%20with%20athletes%2C%20soccer%20players%2C%20basketball%2C%20olympic%20training%2C%20fitness%20center%2C%20professional%20sports%20arena%2C%20championship","fqdn":"app-aave-gho.eu.com","domain":"app-aave-gho.eu.com","tld":"eu.com"},"ip":{"addr":"104.21.95.200","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE","date":"2025-08-13T10:23:22.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"app-aave-gho.eu.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 Aug 2025 20:08:08 GMT","end":"Mon, 10 Nov 2025 21:02:48 GMT"},"fingerprint":{"sha1":"D0:0B:5B:CC:10:ED:92:70:37:C0:72:64:A6:DC:C0:80:AE:7C:BA:23","sha256":"65:57:78:33:83:D5:14:99:CD:C7:67:97:F0:B0:94:3F:AA:A8:F8:3F:36:D9:2A:CA:E1:44:30:34:6A:89:17:88"}}},"request":{"raw":"GET /home/assets/sport-hero.jpeg?prompt=Epic%20sports%20stadium%20with%20athletes%2C%20soccer%20players%2C%20basketball%2C%20olympic%20training%2C%20fitness%20center%2C%20professional%20sports%20arena%2C%20championship HTTP/1.1\r\nHost: app-aave-gho.eu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://app-aave-gho.eu.com/home/?gad_source=1\u0026gad_campaignid=22885626210\u0026gbraid=0AAAAABPaaHS2taLtBR4Y8VHy3hwcpZakf\u0026gclid=CjwKCAjw7_DEBhAeEiwAWKiCC6Pofn_xlLWDnzGug8bZfIuC6yYCuEA5ORkhSBg_koiWJHZGxRebxxoC6S0QAvD_BwE\r\nCookie: _cid=8c5fabb318281197825f7ee2af54e131\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 19 Aug 2025 21:43:42 GMT\r\netag: \"2342f-689412f4-140254;;;\"\r\nlast-modified: Thu, 07 Aug 2025 02:44:04 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 144431\r\naccept-ranges: bytes\r\ndate: Wed, 13 Aug 2025 10:23:22 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\nage: 45580\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DYVFr%2BAyRUtxSEqRP4DKiwmaV1oKtGQK62KCFRTEr5lQdYoOijqqyOtJwlrEsSka%2FmqcsG0ka0d5C5Fa7PjHhnqcA4XDI8aswT5xjDHc4o28\"}]}\r\nvary: accept-encoding\r\ncf-ray: 96e77f266b9056c0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":144431,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3","md5":"e10f0528927684bfcc8eb2128b0a38e9","sha1":"234c4363b5a148f30b1e7cf8ea280fdc1b88e6c3","sha256":"114512965dba0988d92685501b8b6bb150c7f42c25e86beb66a94c16955f97d2","sha512":"82bfe453f610c16014c15d2b90271098122f4fd88904b138b25f775dc4f5cdbcc3dcc26b70c46055f4ca6338fd67450d523eb95389040fe249b8e25867d80f7e","ssdeep":"3072:j+5V+Ghbshfz3W+Iqknqi7PKhjgkJltfmeA5YDd6EdFvBIQs2az5PyMJrkpc9l5:j+5V+GtsRViKhjtfmeAGJp82GPpai","tlshash":"cbe312cedf6c20087304c23dab9df8bc441e9aace68e701df66b79d15e8669701604bc","first_seen":"2025-08-12T16:25:39.337749Z","last_seen":"2025-08-13T10:23:46.851618Z","times_seen":2,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":38,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Mamba Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","mamba","aitm"],"meta":null}]}}]}