{"report_id":"839388ba-1e11-4471-b693-b6dae23aa6c5","version":0,"status":"done","tags":["microsoft","phishing","greatness","honeystorm","aitm"],"date":"2026-08-20T00:28:26Z","url":{"schema":"http","addr":"multimar.com.iq/shared/32936.html","fqdn":"multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"ip":{"addr":"69.175.69.34","port":0,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"www.multimar.com.iq/shared/32936.html","fqdn":"www.multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"title":"OneDrive","dom":{"size":39637,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (11492)","md5":"a87ed1b6331f9f70290dd41fc75dbbc4","sha1":"e8945097a7343f2e2901c7c05e4277a7af886d56","sha256":"a1b6030f298f7ce46603a8ab057fca5fce7e83683c17e1e8b5319867ab2b9347","sha512":"59dc757e97e07471b3c9e01968d93d0ca00d4ac524342d6ba21080f2b70614f230500898ec88384b2e547459e211d9192066f86ddc879797c68196ca1f7e5b57","ssdeep":"768:fN7JlrT3koALL9zpfxtq7iEs9lL06cST3koALL9zpPi:h33koGLbffu6c63koGLba","tlshash":"e5039da662c1843f358f99d3f06157ce3b648217e516e257f72c7aa48fd0e93c53a228","dom_hash":"domhash441f28f5a78d9612de70b5bd801e3b71","first_seen":"2026-08-20T00:28:32.10102Z","last_seen":"2026-08-20T00:28:32.10102Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"multimar.com.iq/shared/32936.html","fqdn":"multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"ip":{"addr":"69.175.69.34","port":0,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-24T00:28:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"admin.greatoss.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Greatness Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","greatness","honeystorm","aitm"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Greatness Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","greatness","honeystorm","aitm"],"meta":null}]},"summary":[{"fqdn":"www.clipartmax.com","ip":{"addr":"104.243.43.77","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"domain_registered":"2018-06-26","domain_rank":444339,"first_seen":"2018-08-10T13:48:29Z","last_seen":"2026-08-12T19:33:29.860692Z","alert_count":0,"request_count":1,"received_data":55429,"sent_data":592,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"multimar.com.iq","ip":{"addr":"69.175.69.34","port":443,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":411,"sent_data":501,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"www.multimar.com.iq","ip":{"addr":"69.175.69.34","port":443,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":4,"request_count":2,"received_data":40610,"sent_data":1036,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"admin.greatoss.sbs","ip":{"addr":"172.67.195.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-10","domain_rank":0,"first_seen":"2026-08-07T23:09:03.266417Z","last_seen":"2026-08-16T00:14:06.382341Z","alert_count":5,"request_count":5,"received_data":4604,"sent_data":2895,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"encrypted-tbn0.gstatic.com","ip":{"addr":"142.250.178.110","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2013-05-31T02:32:18Z","last_seen":"2026-08-13T19:57:18.571379Z","alert_count":0,"request_count":1,"received_data":1421,"sent_data":601,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Greatness Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","greatness","honeystorm","aitm"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"www.multimar.com.iq/shared/32936.html","fqdn":"www.multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"ip":{"addr":"69.175.69.34","port":443,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"4a69559f9874b79a649180e8e44954fe","sha1":"4e8659ef7967bf4d18052d70d0cfed636a80b936","sha256":"1b5712694c1890517a9da933ebf7e74fb4e5b4810c6338832cc097a2efc6add8","sha512":"703f8afe9f4086aa61acd9cfea79d77a7a9e775028e06269ba6fa3d9e211cec349f577139deab1da5d1bfa10f1454aa26b7ccae7f10c2cd8fa09a02121870093","ssdeep":"384:Z7iiNeZilmii4GL0izqNSJ3A36xoeictkhHpx3WkvLseFTdvzpU46Ma/8A3A7z9R:Z7iEs9lL06cST3koALL9zpP7","tlshash":"6f926ede62d2cc7b0adf2aa7b52557883975412b6841a203f72c7aa40fb0e47c17f539","size":19942,"data":"","first_seen":"2026-08-20T00:28:32.124088Z","last_seen":"2026-08-20T02:33:11.760775Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.multimar.com.iq/shared/32936.html","fqdn":"www.multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"ip":{"addr":"69.175.69.34","port":443,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"introduction_type":"eval","is_inline":false,"md5":"61fa153f2827c887a48a351ae3c6cfd3","sha1":"5fbd02245cf700ea94d638c8d76924ecca52d330","sha256":"4c44d7c28ec0f6ca3e2624c6af1d3be324576d01ef6f6c2dc0af7e61664b8c2c","sha512":"cbe467dc51f0eec90d8b40bc35a1a0eb2c320ac67cc022c518b431987fa05a3d565f793c377d5f33a612555ad4d7ad66acfb4b47ba6323da26db293f095257d8","ssdeep":"","tlshash":"c650000003000000030c0000c000000000000003000030c000c0000000000000000000","size":8,"data":"","first_seen":"2023-03-07T01:03:50Z","last_seen":"2026-08-20T02:33:11.760157Z","times_seen":18935,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"multimar.com.iq/shared/32936.html","fqdn":"multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"ip":{"addr":"69.175.69.34","port":443,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-20T00:27:56.888Z","timestamp":1787185676888,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.multimar.com.iq","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Jun 2026 07:57:32 GMT","end":"Sun, 27 Sep 2026 07:57:31 GMT"},"fingerprint":{"sha1":"58:5A:C3:8F:2B:7A:4F:99:48:E6:69:1A:93:F3:0F:ED:A9:5C:86:F0","sha256":"EC:19:FF:97:DD:F5:A0:40:C1:8A:20:70:45:1A:6E:26:B3:8B:78:89:41:FA:7C:E1:6F:E1:DF:81:43:BF:12:E4"}}},"request":{"raw":"GET /shared/32936.html HTTP/1.1\r\nHost: multimar.com.iq\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Thu, 20 Aug 2026 00:27:57 GMT\r\nServer: Apache\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nLocation: https://www.multimar.com.iq/shared/32936.html\r\nContent-Length: 293\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-20T10:30:42.294956Z","times_seen":17988790,"resource_available":true,"data":null}},"time_used":965,"timings":{"blocked":0,"dns":519,"connect":109,"send":0,"wait":113,"receive":0,"ssl":224},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Greatness Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","greatness","honeystorm","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"www.multimar.com.iq/shared/32936.html","fqdn":"www.multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"ip":{"addr":"69.175.69.34","port":443,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-20T00:27:57.863Z","timestamp":1787185677863,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.multimar.com.iq","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Jun 2026 07:57:32 GMT","end":"Sun, 27 Sep 2026 07:57:31 GMT"},"fingerprint":{"sha1":"58:5A:C3:8F:2B:7A:4F:99:48:E6:69:1A:93:F3:0F:ED:A9:5C:86:F0","sha256":"EC:19:FF:97:DD:F5:A0:40:C1:8A:20:70:45:1A:6E:26:B3:8B:78:89:41:FA:7C:E1:6F:E1:DF:81:43:BF:12:E4"}}},"request":{"raw":"GET /shared/32936.html HTTP/1.1\r\nHost: www.multimar.com.iq\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 20 Aug 2026 00:27:58 GMT\r\nServer: Apache\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nLast-Modified: Mon, 10 Aug 2026 18:21:29 GMT\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 14483\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":39474,"size_decoded":14919,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (11492)","md5":"f683b87252ab3eca804ca1ba38a906f3","sha1":"8f610005ce103a65f0ceba629e230b074c0dd905","sha256":"8fb81be362e387bc4dbf04c10ccf0fd5b2534020005eb6e2636f98e68a9c3c43","sha512":"0781d21808a60ce7e3739949a842b233af0ec8b1d7880ecebee68f1c52c90e58c855742433c5b579382ad7298c4064716b6c6b92e1f26c50a2b65e5488631277","ssdeep":"768:DN7JlbT3koALL9zpf/lq7iEs9lL06cST3koALL9zpPh:VH3koGLbftu6c63koGLbZ","tlshash":"2a039da662c1843f358f89d3f16157ce3b648217e516a257f72c7aa48fd0e93c53a22c","first_seen":"2026-08-20T00:28:32.108663Z","last_seen":"2026-08-20T02:33:11.753992Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1099,"timings":{"blocked":-1,"dns":649,"connect":110,"send":0,"wait":117,"receive":109,"ssl":114},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Greatness Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","greatness","honeystorm","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"admin.greatoss.sbs/admin/apifiles.php?action=get_device_code\u0026user_id=MTgxODkzMTY2Mg==","fqdn":"admin.greatoss.sbs","domain":"greatoss.sbs","tld":"sbs"},"ip":{"addr":"172.67.195.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:27:59.267Z","timestamp":1787185679267,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"greatoss.sbs","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 11:35:34 GMT","end":"Thu, 08 Oct 2026 12:33:13 GMT"},"fingerprint":{"sha1":"8E:7F:3C:FC:D6:23:E0:7C:2A:E3:37:47:AB:87:27:26:ED:08:0E:6B","sha256":"E9:4C:C4:DE:70:3C:93:69:18:86:D8:A4:CE:69:ED:1A:15:15:37:18:ED:3B:BF:1E:45:6D:1C:19:1B:1E:FC:D7"}}},"request":{"raw":"GET /admin/apifiles.php?action=get_device_code\u0026user_id=MTgxODkzMTY2Mg== HTTP/1.1\r\nHost: admin.greatoss.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/\r\nOrigin: https://www.multimar.com.iq\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 20 Aug 2026 00:28:01 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nzMv5ewlePsPxec9f%2BuDOtmUfzPaMHMTP4TRa9Y2mVIElzwudAVUlHOI0ey3plmM7qI7qZEVzcq0DvToUBejtsMpz4EUbQnF0VuORMAD3hRFpct0Tx53hfQKizM3GdT73xgKgiU%3D\"}]}\r\npriority: u=4,i=?0\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a2dd46801d960afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":942,"size_decoded":1474,"mime_type":"application/json","magic":"JSON text data","md5":"2ced12dca4ab74db0423c4febdb30d1a","sha1":"80f1a49a48022515eb32759ac717d6d381211b0a","sha256":"757e6dc195e2a2c3b39ca59dedfcb39cdc003dc1d706500850c4a7bae458760e","sha512":"b6dabd5603a30cc20329666fb0db2181463c9a6b050ea735cb6f4b1a5f8b3f1988618db1e43069ead69a1b2bf309953b43ca747bd75906573ba290c074832e71","ssdeep":"","tlshash":"a311889c4c76b58146eb9e9162b5da04695155124c1ec22081fff7f984067ead319708","first_seen":"2026-08-20T00:28:32.113453Z","last_seen":"2026-08-20T00:28:32.113453Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1784,"timings":{"blocked":-1,"dns":98,"connect":16,"send":0,"wait":1670,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"admin.greatoss.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.multimar.com.iq/favicon.ico","fqdn":"www.multimar.com.iq","domain":"multimar.com.iq","tld":"com.iq"},"ip":{"addr":"69.175.69.34","port":443,"asn":32475,"as":"SINGLEHOP-LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:27:59.479Z","timestamp":1787185679479,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.multimar.com.iq","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Jun 2026 07:57:32 GMT","end":"Sun, 27 Sep 2026 07:57:31 GMT"},"fingerprint":{"sha1":"58:5A:C3:8F:2B:7A:4F:99:48:E6:69:1A:93:F3:0F:ED:A9:5C:86:F0","sha256":"EC:19:FF:97:DD:F5:A0:40:C1:8A:20:70:45:1A:6E:26:B3:8B:78:89:41:FA:7C:E1:6F:E1:DF:81:43:BF:12:E4"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.multimar.com.iq\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/shared/32936.html\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Thu, 20 Aug 2026 00:27:59 GMT\r\nServer: Apache\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nContent-Length: 355\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":355,"size_decoded":700,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-08-20T10:26:20.449327Z","times_seen":58595,"resource_available":true,"data":null}},"time_used":115,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":115,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Greatness Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","greatness","honeystorm","aitm"],"meta":null}]}},{"url":{"schema":"https","addr":"admin.greatoss.sbs/admin/apifiles.php?action=poll_token","fqdn":"admin.greatoss.sbs","domain":"greatoss.sbs","tld":"sbs"},"ip":{"addr":"172.67.195.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:28:06.072Z","timestamp":1787185686072,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"greatoss.sbs","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 11:35:34 GMT","end":"Thu, 08 Oct 2026 12:33:13 GMT"},"fingerprint":{"sha1":"8E:7F:3C:FC:D6:23:E0:7C:2A:E3:37:47:AB:87:27:26:ED:08:0E:6B","sha256":"E9:4C:C4:DE:70:3C:93:69:18:86:D8:A4:CE:69:ED:1A:15:15:37:18:ED:3B:BF:1E:45:6D:1C:19:1B:1E:FC:D7"}}},"request":{"raw":"POST /admin/apifiles.php?action=poll_token HTTP/1.1\r\nHost: admin.greatoss.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/\r\nContent-Type: application/x-www-form-urlencoded;charset=UTF-8\r\nContent-Length: 852\r\nOrigin: https://www.multimar.com.iq\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":852,"data":"device_code=FBgABIQEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzAQAAAAAAmrTnVmVHDqH3uLT3XWzELtwrlR54K5MjZzK_-NfwqtDgC3e2WURjkJ4XluUxRf_WUjU6A1GKgScdIuo5WiwAhazl6RH09xrhh_5BeCeHmuI2scbfBHSZaoepEGbRoqX34rFAkFuVYLS9OO33dDkXJQAvNFoXgayYEWLkHymyxsWKIfoxvoBEHhKnlKBMFr-8vHvctMau5qFY_MKx-pZWnVIgleCEcwdxHCaQa09YFD_vebv_1zV3JAwALbRrHXD24ggG8NiXDYwUAhpvaKulaNcn6hLF4Fv5pFnpp5DOvkwUy2NILlKgLwktp8GLxsi6KR4px0mEDTMkRK65y9pB6TskP7diFYJE-7laih3h9LgtE4i42rNDP_MaMht2WTXtXDEdMRoazNVh2QDnTLOhMHCvRpavPB2UwlLQ-sdBG28m_DbRZtXH4TDfh68c15A--N5lHQiGhBgN1XsKjJsuCw8-1lYVIqffSWSbyhezkGl0BN5wj_36tK7gEhvD-7aIml9a6mizU-lb3I5r9RJCHCos2Cjzumldpca9uly0lyEqkGMuj-CWnlXSvzo0ntRWmL0Zf_PpfVpiA2dD1OAEmhAoPsmaMDryku9iK6YvX6OdfLWCHR7D7_7lsNVfcdWEm45deVDIIJaM1p1x3jn3k5rowwgqUHckdN9e4igWPilyk9tBz4rzz_U4aul7sUjQxjPKenF1xUsdNn0Hnf-82zny_YYPzWm2F34n5VaR2XsgAA\u0026user_id=MTgxODkzMTY2Mg%3D%3D"}},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 20 Aug 2026 00:28:06 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CsmGdw%2BY1NndJ2lQdX9CQPLQRcdQCoXs6yoXtB%2Baz6ri17A4hYDGyL3pgoOYeRgVrf5fA8Wc28x%2F1cq7mBuigeUoWUa1wFrOZK%2BgA%2FOq1xQz9TFq4kMUsP5XoP9nZNAByQni%2FHs%3D\"}]}\r\npriority: u=4,i=?0\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a2dd46a9edbf0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20,"size_decoded":750,"mime_type":"application/json","magic":"JSON text data","md5":"f6c2899bb01c7306947b98df4122dfbe","sha1":"d35ea1559102d6777ea5920b0084f17197c44ae5","sha256":"a839711b15b8e9862282ec0ed1034f134efb54b5d9969e66ea285babef923d4a","sha512":"82437bee130f7a7680b7b047b16a07065170b31bb204daff6005536ef11829d678583007f6df147c67802fe6f9af70e8861d39eab8d2787d20bc48be24bc1478","ssdeep":"","tlshash":"30700022280800000ac80800e0000230baa08a80002ba0c0200c00288820880e008000","first_seen":"2024-08-20T12:53:41.601958Z","last_seen":"2026-08-20T10:07:42.848391Z","times_seen":3920,"resource_available":true,"data":null}},"time_used":690,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":690,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"admin.greatoss.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"admin.greatoss.sbs/admin/apifiles.php?action=poll_token","fqdn":"admin.greatoss.sbs","domain":"greatoss.sbs","tld":"sbs"},"ip":{"addr":"172.67.195.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:28:21.071Z","timestamp":1787185701071,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"greatoss.sbs","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 11:35:34 GMT","end":"Thu, 08 Oct 2026 12:33:13 GMT"},"fingerprint":{"sha1":"8E:7F:3C:FC:D6:23:E0:7C:2A:E3:37:47:AB:87:27:26:ED:08:0E:6B","sha256":"E9:4C:C4:DE:70:3C:93:69:18:86:D8:A4:CE:69:ED:1A:15:15:37:18:ED:3B:BF:1E:45:6D:1C:19:1B:1E:FC:D7"}}},"request":{"raw":"POST /admin/apifiles.php?action=poll_token HTTP/1.1\r\nHost: admin.greatoss.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/\r\nContent-Type: application/x-www-form-urlencoded;charset=UTF-8\r\nContent-Length: 852\r\nOrigin: https://www.multimar.com.iq\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":852,"data":"device_code=FBgABIQEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzAQAAAAAAmrTnVmVHDqH3uLT3XWzELtwrlR54K5MjZzK_-NfwqtDgC3e2WURjkJ4XluUxRf_WUjU6A1GKgScdIuo5WiwAhazl6RH09xrhh_5BeCeHmuI2scbfBHSZaoepEGbRoqX34rFAkFuVYLS9OO33dDkXJQAvNFoXgayYEWLkHymyxsWKIfoxvoBEHhKnlKBMFr-8vHvctMau5qFY_MKx-pZWnVIgleCEcwdxHCaQa09YFD_vebv_1zV3JAwALbRrHXD24ggG8NiXDYwUAhpvaKulaNcn6hLF4Fv5pFnpp5DOvkwUy2NILlKgLwktp8GLxsi6KR4px0mEDTMkRK65y9pB6TskP7diFYJE-7laih3h9LgtE4i42rNDP_MaMht2WTXtXDEdMRoazNVh2QDnTLOhMHCvRpavPB2UwlLQ-sdBG28m_DbRZtXH4TDfh68c15A--N5lHQiGhBgN1XsKjJsuCw8-1lYVIqffSWSbyhezkGl0BN5wj_36tK7gEhvD-7aIml9a6mizU-lb3I5r9RJCHCos2Cjzumldpca9uly0lyEqkGMuj-CWnlXSvzo0ntRWmL0Zf_PpfVpiA2dD1OAEmhAoPsmaMDryku9iK6YvX6OdfLWCHR7D7_7lsNVfcdWEm45deVDIIJaM1p1x3jn3k5rowwgqUHckdN9e4igWPilyk9tBz4rzz_U4aul7sUjQxjPKenF1xUsdNn0Hnf-82zny_YYPzWm2F34n5VaR2XsgAA\u0026user_id=MTgxODkzMTY2Mg%3D%3D"}},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 20 Aug 2026 00:28:21 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6G%2F7ZkJhlMYcLDvAnIIa%2F49o1HsjQogWK9Zag4cuHyvA%2BnS9h9pCshp%2FKPcdR6v%2FzUj6JLaIJRf9SO%2ByU%2FdEWj9qUWbG6c8WH35lTRh%2B6Dv9rz2UpA8RSJnrUhBjEiXOrOaa400%3D\"}]}\r\npriority: u=4,i=?0\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a2dd4707ae2f0afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20,"size_decoded":751,"mime_type":"application/json","magic":"JSON text data","md5":"f6c2899bb01c7306947b98df4122dfbe","sha1":"d35ea1559102d6777ea5920b0084f17197c44ae5","sha256":"a839711b15b8e9862282ec0ed1034f134efb54b5d9969e66ea285babef923d4a","sha512":"82437bee130f7a7680b7b047b16a07065170b31bb204daff6005536ef11829d678583007f6df147c67802fe6f9af70e8861d39eab8d2787d20bc48be24bc1478","ssdeep":"","tlshash":"30700022280800000ac80800e0000230baa08a80002ba0c0200c00288820880e008000","first_seen":"2024-08-20T12:53:41.601958Z","last_seen":"2026-08-20T10:07:42.848391Z","times_seen":3920,"resource_available":true,"data":null}},"time_used":309,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"admin.greatoss.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQVu_punmVpXPehlmF-zb9LO30EZQRtHpK7KA\u0026s","fqdn":"encrypted-tbn0.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.110","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:27:59.264Z","timestamp":1787185679264,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /images?q=tbn:ANd9GcQVu_punmVpXPehlmF-zb9LO30EZQRtHpK7KA\u0026s HTTP/1.1\r\nHost: encrypted-tbn0.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"images-tbn\"\r\nreport-to: {\"group\":\"images-tbn\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/images-tbn\"}]}\r\ncontent-length: 612\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 20 Aug 2026 00:27:59 GMT\r\nexpires: Fri, 20 Aug 2027 00:27:59 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 01 Oct 2019 13:58:09 GMT\r\ncontent-type: image/png\r\nage: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":612,"size_decoded":1421,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"39960320151e73d7bef23fc62781f802","sha1":"4800ad008a9b7dff06c5b6e8b47201a116579339","sha256":"cd7e40bf0cf761d07a73a6a7a2dc1da2c1f19d0ba2e95a1d524a4f50cf8a4c7a","sha512":"6f8cb354a84f8b23933c22e8e0bad2b95cfbfed6575b3afe48bc7bccf0e4ab44ba5e7ca2dc1d735044fa6f8cbe7b4c28181a14583dd455ab0c8d00400144723e","ssdeep":"","tlshash":"b8f023faf8386f66d468903013112036cec5a06a448ada768183c69a1dfa18d70c4b7f","first_seen":"2026-02-07T00:34:01.699335Z","last_seen":"2026-08-20T02:33:11.758967Z","times_seen":67,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":0,"dns":2,"connect":16,"send":0,"wait":28,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.clipartmax.com/png/middle/112-1120242_download-icon-folder-icon-png.png","fqdn":"www.clipartmax.com","domain":"clipartmax.com","tld":"com"},"ip":{"addr":"104.243.43.77","port":443,"asn":23470,"as":"RELIABLESITE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:27:59.265Z","timestamp":1787185679265,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"clipartmax.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 21 Jul 2026 23:12:16 GMT","end":"Mon, 19 Oct 2026 23:12:15 GMT"},"fingerprint":{"sha1":"20:0A:93:12:11:F8:24:7B:5A:3E:88:25:82:D8:3F:B4:FD:F4:EA:38","sha256":"19:5F:13:6B:A1:F9:3A:10:8E:83:21:22:C5:D1:73:82:84:E7:72:CB:3E:EB:69:C1:92:A9:16:4B:49:BC:AD:8F"}}},"request":{"raw":"GET /png/middle/112-1120242_download-icon-folder-icon-png.png HTTP/1.1\r\nHost: www.clipartmax.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.22.1\r\nDate: Thu, 20 Aug 2026 00:30:21 GMT\r\nContent-Type: image/png\r\nLast-Modified: Wed, 18 Jul 2018 13:30:39 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"5b4f40ff-d774\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.22.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55156,"size_decoded":21475,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 840x471, components 3","md5":"76766266d44183cef1d4092ed94fb407","sha1":"ac5d0aa1a7995498f52b8215c8509ebfd35c853f","sha256":"7d7aa131dd6dc8fb145920b105db6a17cc532d1fc4228fb6c0c39fb3f3172c63","sha512":"61acab3079eafa814a9c10b534a5567646badbfabf62067428c120dec0671d1f5485bdd4738dcef31b03902afb016411f6a21e1677a3058e859dfc30a7f23cae","ssdeep":"768:hfRRVH8V7Jl5k1Jv111LtN7WR9fRpiAhC+i3swwwNADIwiO3dU666666oDXqxoec:h9H6k1Jv111Ltq9fRpiA3jwwwz0vOCf7","tlshash":"5a439fa714209b50ee1f4ab5b7177f9d02d5267c3b05a0d78a2a4ce5f7ec0a019d2be3","first_seen":"2026-06-22T15:45:18.17148Z","last_seen":"2026-08-20T02:33:11.759563Z","times_seen":8,"resource_available":false,"data":null}},"time_used":455,"timings":{"blocked":-1,"dns":2,"connect":89,"send":0,"wait":178,"receive":0,"ssl":187},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"admin.greatoss.sbs/admin/apifiles.php?action=poll_token","fqdn":"admin.greatoss.sbs","domain":"greatoss.sbs","tld":"sbs"},"ip":{"addr":"172.67.195.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:28:11.071Z","timestamp":1787185691071,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"greatoss.sbs","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 11:35:34 GMT","end":"Thu, 08 Oct 2026 12:33:13 GMT"},"fingerprint":{"sha1":"8E:7F:3C:FC:D6:23:E0:7C:2A:E3:37:47:AB:87:27:26:ED:08:0E:6B","sha256":"E9:4C:C4:DE:70:3C:93:69:18:86:D8:A4:CE:69:ED:1A:15:15:37:18:ED:3B:BF:1E:45:6D:1C:19:1B:1E:FC:D7"}}},"request":{"raw":"POST /admin/apifiles.php?action=poll_token HTTP/1.1\r\nHost: admin.greatoss.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/\r\nContent-Type: application/x-www-form-urlencoded;charset=UTF-8\r\nContent-Length: 852\r\nOrigin: https://www.multimar.com.iq\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":852,"data":"device_code=FBgABIQEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzAQAAAAAAmrTnVmVHDqH3uLT3XWzELtwrlR54K5MjZzK_-NfwqtDgC3e2WURjkJ4XluUxRf_WUjU6A1GKgScdIuo5WiwAhazl6RH09xrhh_5BeCeHmuI2scbfBHSZaoepEGbRoqX34rFAkFuVYLS9OO33dDkXJQAvNFoXgayYEWLkHymyxsWKIfoxvoBEHhKnlKBMFr-8vHvctMau5qFY_MKx-pZWnVIgleCEcwdxHCaQa09YFD_vebv_1zV3JAwALbRrHXD24ggG8NiXDYwUAhpvaKulaNcn6hLF4Fv5pFnpp5DOvkwUy2NILlKgLwktp8GLxsi6KR4px0mEDTMkRK65y9pB6TskP7diFYJE-7laih3h9LgtE4i42rNDP_MaMht2WTXtXDEdMRoazNVh2QDnTLOhMHCvRpavPB2UwlLQ-sdBG28m_DbRZtXH4TDfh68c15A--N5lHQiGhBgN1XsKjJsuCw8-1lYVIqffSWSbyhezkGl0BN5wj_36tK7gEhvD-7aIml9a6mizU-lb3I5r9RJCHCos2Cjzumldpca9uly0lyEqkGMuj-CWnlXSvzo0ntRWmL0Zf_PpfVpiA2dD1OAEmhAoPsmaMDryku9iK6YvX6OdfLWCHR7D7_7lsNVfcdWEm45deVDIIJaM1p1x3jn3k5rowwgqUHckdN9e4igWPilyk9tBz4rzz_U4aul7sUjQxjPKenF1xUsdNn0Hnf-82zny_YYPzWm2F34n5VaR2XsgAA\u0026user_id=MTgxODkzMTY2Mg%3D%3D"}},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 20 Aug 2026 00:28:11 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FhHXPusReki3%2FRPLpayeASNc2KJat4mAf0DIHeiCF5YoQjjm4X84O%2B3ffMHzmDbEK6a%2FbBJ9lq8yhN1zRcg70jkrFhLEF2pyLMnkqYQZa1HVljODaNhpNVmEFOL29uf3w48m%2Fl0%3D\"}]}\r\npriority: u=4,i=?0\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a2dd46c92de70afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20,"size_decoded":743,"mime_type":"application/json","magic":"JSON text data","md5":"f6c2899bb01c7306947b98df4122dfbe","sha1":"d35ea1559102d6777ea5920b0084f17197c44ae5","sha256":"a839711b15b8e9862282ec0ed1034f134efb54b5d9969e66ea285babef923d4a","sha512":"82437bee130f7a7680b7b047b16a07065170b31bb204daff6005536ef11829d678583007f6df147c67802fe6f9af70e8861d39eab8d2787d20bc48be24bc1478","ssdeep":"","tlshash":"30700022280800000ac80800e0000230baa08a80002ba0c0200c00288820880e008000","first_seen":"2024-08-20T12:53:41.601958Z","last_seen":"2026-08-20T10:07:42.848391Z","times_seen":3920,"resource_available":true,"data":null}},"time_used":299,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":299,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"admin.greatoss.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"admin.greatoss.sbs/admin/apifiles.php?action=poll_token","fqdn":"admin.greatoss.sbs","domain":"greatoss.sbs","tld":"sbs"},"ip":{"addr":"172.67.195.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.multimar.com.iq/shared/32936.html","date":"2026-08-20T00:28:16.071Z","timestamp":1787185696071,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"greatoss.sbs","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 11:35:34 GMT","end":"Thu, 08 Oct 2026 12:33:13 GMT"},"fingerprint":{"sha1":"8E:7F:3C:FC:D6:23:E0:7C:2A:E3:37:47:AB:87:27:26:ED:08:0E:6B","sha256":"E9:4C:C4:DE:70:3C:93:69:18:86:D8:A4:CE:69:ED:1A:15:15:37:18:ED:3B:BF:1E:45:6D:1C:19:1B:1E:FC:D7"}}},"request":{"raw":"POST /admin/apifiles.php?action=poll_token HTTP/1.1\r\nHost: admin.greatoss.sbs\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://www.multimar.com.iq/\r\nContent-Type: application/x-www-form-urlencoded;charset=UTF-8\r\nContent-Length: 852\r\nOrigin: https://www.multimar.com.iq\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":852,"data":"device_code=FBgABIQEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzAQAAAAAAmrTnVmVHDqH3uLT3XWzELtwrlR54K5MjZzK_-NfwqtDgC3e2WURjkJ4XluUxRf_WUjU6A1GKgScdIuo5WiwAhazl6RH09xrhh_5BeCeHmuI2scbfBHSZaoepEGbRoqX34rFAkFuVYLS9OO33dDkXJQAvNFoXgayYEWLkHymyxsWKIfoxvoBEHhKnlKBMFr-8vHvctMau5qFY_MKx-pZWnVIgleCEcwdxHCaQa09YFD_vebv_1zV3JAwALbRrHXD24ggG8NiXDYwUAhpvaKulaNcn6hLF4Fv5pFnpp5DOvkwUy2NILlKgLwktp8GLxsi6KR4px0mEDTMkRK65y9pB6TskP7diFYJE-7laih3h9LgtE4i42rNDP_MaMht2WTXtXDEdMRoazNVh2QDnTLOhMHCvRpavPB2UwlLQ-sdBG28m_DbRZtXH4TDfh68c15A--N5lHQiGhBgN1XsKjJsuCw8-1lYVIqffSWSbyhezkGl0BN5wj_36tK7gEhvD-7aIml9a6mizU-lb3I5r9RJCHCos2Cjzumldpca9uly0lyEqkGMuj-CWnlXSvzo0ntRWmL0Zf_PpfVpiA2dD1OAEmhAoPsmaMDryku9iK6YvX6OdfLWCHR7D7_7lsNVfcdWEm45deVDIIJaM1p1x3jn3k5rowwgqUHckdN9e4igWPilyk9tBz4rzz_U4aul7sUjQxjPKenF1xUsdNn0Hnf-82zny_YYPzWm2F34n5VaR2XsgAA\u0026user_id=MTgxODkzMTY2Mg%3D%3D"}},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 20 Aug 2026 00:28:16 GMT\r\nserver: cloudflare\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS\r\naccess-control-allow-headers: Content-Type\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3oj3SI0w0BG%2FjeescYokeDhoxCfMtcunnpARCzOc%2FfRnmrbnNSNwSAuVaNnfgnd2I8QK%2BPvyDTXOGwnrVN6oJ%2B1Drazzl%2BjNMO96Hr%2Fwn1qwWHTbhN6AXaKM%2F2gJeYr3PI4VBNE%3D\"}]}\r\npriority: u=4,i=?0\r\ncontent-type: application/json\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a2dd46e86e050afe-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20,"size_decoded":749,"mime_type":"application/json","magic":"JSON text data","md5":"f6c2899bb01c7306947b98df4122dfbe","sha1":"d35ea1559102d6777ea5920b0084f17197c44ae5","sha256":"a839711b15b8e9862282ec0ed1034f134efb54b5d9969e66ea285babef923d4a","sha512":"82437bee130f7a7680b7b047b16a07065170b31bb204daff6005536ef11829d678583007f6df147c67802fe6f9af70e8861d39eab8d2787d20bc48be24bc1478","ssdeep":"","tlshash":"30700022280800000ac80800e0000230baa08a80002ba0c0200c00288820880e008000","first_seen":"2024-08-20T12:53:41.601958Z","last_seen":"2026-08-20T10:07:42.848391Z","times_seen":3920,"resource_available":true,"data":null}},"time_used":287,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":287,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-20","alert":"Sinkholed","trigger":"admin.greatoss.sbs","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}