{"report_id":"86c90518-d7e6-4e1b-9f31-6e2cbde51fdb","version":0,"status":"done","tags":["swisspass","phishing","transport"],"date":"2026-09-17T03:42:24Z","url":{"schema":"http","addr":"304shark.info/dXNlcg","fqdn":"304shark.info","domain":"304shark.info","tld":"info"},"ip":{"addr":"194.30.191.151","port":0,"asn":8447,"as":"Telekom Austria","country":"Austria","country_code":"AT"},"final":{"url":{"schema":"https","addr":"play2information.com/WsvKPLzZb/infoclient/mXKgmrdz/","fqdn":"play2information.com","domain":"play2information.com","tld":"com"},"title":"Login | SwissPass","dom":{"size":658175,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (38605)","md5":"77c0e04bed349fd8bc81c4044ed5653a","sha1":"1daccdc6c09057eec4f3ffd01245ca9d3c402f65","sha256":"c64a42977bf89e80c999462a6a0e7c5ad27d219a0ad7af2fb6b29621d1f19b95","sha512":"17fcadf7731e7d4db99c8ede66b16bb9e2c53544cea81c156c42ee09d774ed0532b7499ec1ad6827db3906bc5f493ad1f7acd9ebd4be46be301b94b8944a7168","ssdeep":"12288:P0gCr0trMus838zKLGCew1dsu4VGRhe8cm7e58zhYxDVW5Yze3TV3Q7lwZH9a12U:PVMus8oKCCh+TyheHX589OM5Y4TV3Q7V","tlshash":"07e4ae338e1b2e562f743a6646df2ace2d1ce3c764828ac4b4dd1a90df5db4534c629c","dom_hash":"domhashaddf7696f9878042387b7f1ab55c81b4","first_seen":"2026-09-17T03:42:28.507393Z","last_seen":"2026-09-17T03:42:28.507393Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"304shark.info/dXNlcg","fqdn":"304shark.info","domain":"304shark.info","tld":"info"},"ip":{"addr":"194.30.191.151","port":0,"asn":8447,"as":"Telekom Austria","country":"Austria","country_code":"AT"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-22T03:42:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"summary":[{"fqdn":"304shark.info","ip":{"addr":"194.30.191.151","port":443,"asn":8447,"as":"Telekom Austria","country":"Austria","country_code":"AT"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-15T10:48:06.860151Z","last_seen":"2026-09-15T10:48:06.860151Z","alert_count":6,"request_count":3,"received_data":18613,"sent_data":1486,"comment":"","tags":null,"fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}]},{"fqdn":"play2information.com","ip":{"addr":"66.235.200.147","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"domain_registered":"2026-09-15","domain_rank":0,"first_seen":"2026-09-17T03:42:25.333395Z","last_seen":"2026-09-17T03:42:25.333395Z","alert_count":2,"request_count":2,"received_data":666794,"sent_data":1340,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bluehost","description":"Bluehost is a large web host known for its WordPress expertise, variety of “one-stop-shop” services, and bargain prices.","website":"https://www.bluehost.com","common_platform_enumeration":"","icon":"Bluehost.svg","categories":["Hosting"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"c69314e0acd5579f1a12688806ab6e49","sha1":"3a9a49a4cc43a2f5906a9bb4e45c2078d9c67042","sha256":"56c7ef957f3bf7fb795b2221f3f19a418a050f8a660312c6b30736081d2e5bfa","sha512":"9b77d08808d0fcf23e877ebb51c3699b9998f1efc6cbb108bd1a535e94a94ea8857744833679893fb60cd972bb1555b0024b3caf5b993d1c2aef708e4c75b6a5","ssdeep":"","tlshash":"33d0236d2d75843056dc01867075d3a8357020616721d6c4c1c8cc1fde11ed304b195c","size":217,"data":"","first_seen":"2026-09-17T03:42:28.51504Z","last_seen":"2026-09-17T03:42:28.51504Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"304shark.info/dXNlcg/","fqdn":"304shark.info","domain":"304shark.info","tld":"info"},"ip":{"addr":"194.30.191.151","port":443,"asn":8447,"as":"Telekom Austria","country":"Austria","country_code":"AT"},"introduction_type":"scriptElement","is_inline":true,"md5":"4375945216133db4cc5c4dc7aeb95f64","sha1":"eea78610312561dd8bcca9d68a54e325215a1280","sha256":"c739a6c18b4848fefde391e804b197b80b0e12832cfebf09610887f902ae0243","sha512":"331defeb746af15cb8e7f934be2c7036669a0a21a4a5b210ab36690cb70960186bcda2c849aacb0e1322e92c405d9925e2a6784b564dcf7a0598a92a11d817c7","ssdeep":"","tlshash":"1ce026da62a66836cdb7121f750b920d2473b25a3e0dc540c88d024009182a6e21ea0f","size":334,"data":"","first_seen":"2026-09-17T03:42:28.518116Z","last_seen":"2026-09-17T03:42:28.518116Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"304shark.info/dXNlcg/","fqdn":"304shark.info","domain":"304shark.info","tld":"info"},"ip":{"addr":"194.30.191.151","port":443,"asn":8447,"as":"Telekom Austria","country":"Austria","country_code":"AT"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T03:41:54.304Z","timestamp":1789616514304,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dXNlcg/ HTTP/1.1\r\nHost: 304shark.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":60413\"; ma=2592000,h3=\":60414\"; ma=2592000,h3=\":60418\"; ma=2592000\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Thu, 17 Sep 2026 03:41:54 GMT\r\netag: \"19c-65ba48ba0034a-gzip\"\r\nlast-modified: Thu, 17 Sep 2026 02:28:55 GMT\r\nserver: BitNinja-WafPro\r\nvary: Accept-Encoding\r\nvia: 1.1 Caddy\r\nx-accel-version: 0.01\r\nx-powered-by: PleskLin\r\ncontent-length: 275\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T00:48:29.776235Z","times_seen":18608930,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"play2information.com/WsvKPLzZb/infoclient/mXKgmrdz/media/logo-20200819.png","fqdn":"play2information.com","domain":"play2information.com","tld":"com"},"ip":{"addr":"66.235.200.147","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://play2information.com/WsvKPLzZb/infoclient/mXKgmrdz/","date":"2026-09-17T03:41:55.207Z","timestamp":1789616515207,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"play2information.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 15 Sep 2026 01:10:30 GMT","end":"Mon, 14 Dec 2026 02:10:21 GMT"},"fingerprint":{"sha1":"D2:CE:A1:31:7B:56:B8:AD:A8:04:B9:E0:EA:78:F4:15:77:EE:29:B8","sha256":"C5:8E:33:D4:A3:D6:D2:0C:3D:26:3B:C6:56:7A:D0:70:18:6C:B0:81:6A:0A:36:5F:2C:0B:CA:49:05:D8:97:0C"}}},"request":{"raw":"GET /WsvKPLzZb/infoclient/mXKgmrdz/media/logo-20200819.png HTTP/1.1\r\nHost: play2information.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=252702dcd388b02af297291f4472e78e; __cf_bm=nFDvE07BQzQc77zQ9vGq6gp.24xwZNGdR3XneJK3_YY-1789616514.7190652-1.0.1.1-iXy2tARY1nT6mXrJH18gVSgzAq1KX9mLqTDFcESprCIaqFWCxoW.9Q1xMv6MOgJOX8GSwLIK.k35Ifq.G6.0KucQnCGhQTR5qbsU03kyPumgr0ltl_6TLz4kNGv8zQuH\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 17 Sep 2026 03:41:55 GMT\r\ncontent-type: image/png\r\ncontent-length: 1666\r\nlast-modified: Sun, 10 Aug 2025 02:37:04 GMT\r\naccept-ranges: bytes\r\ncache-control: max-age=86400\r\nexpires: Fri, 18 Sep 2026 02:46:52 GMT\r\nhost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==\r\nserver: cloudflare\r\npriority: u=4,i\r\nvary: accept-encoding\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: ok, orig_size=3605\r\ncf-cache-status: HIT\r\ncf-ray: a3c5191408261a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bluehost","description":"Bluehost is a large web host known for its WordPress expertise, variety of “one-stop-shop” services, and bargain prices.","website":"https://www.bluehost.com","common_platform_enumeration":"","icon":"Bluehost.svg","categories":["Hosting"]}],"data":{"size":1666,"size_decoded":2170,"mime_type":"image/png","magic":"PNG image data, 152 x 24, 8-bit gray+alpha, non-interlaced","md5":"5a383b0354bb2fdab239eff587113f86","sha1":"ed74502e4cb4086661ca2a969e116041ba75ada1","sha256":"18362f86f5666d7f25ba55139694f14bfe174c881e42afaf9888e21f3981a87d","sha512":"5325c472c03c777f793be498893b1c76831d1c4cdd5973de7a2a0aa9c4fbf8dda3a865836f3542168677c4c4053a16975e0383ab418fef163d0bf0e8326673d8","ssdeep":"","tlshash":"9431f8f3ef9c78427d5902ffd26e2e3ef547bb7148b2ab08c112861a24345661528956","first_seen":"2026-09-17T03:42:28.510607Z","last_seen":"2026-09-17T03:42:28.510607Z","times_seen":1,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"304shark.info/dXNlcg","fqdn":"304shark.info","domain":"304shark.info","tld":"info"},"ip":{"addr":"194.30.191.151","port":443,"asn":8447,"as":"Telekom Austria","country":"Austria","country_code":"AT"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T03:41:54.157Z","timestamp":1789616514157,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dXNlcg HTTP/1.1\r\nHost: 304shark.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\nalt-svc: h3=\":60413\"; ma=2592000,h3=\":60414\"; ma=2592000,h3=\":60418\"; ma=2592000\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Thu, 17 Sep 2026 03:41:54 GMT\r\nlocation: https://304shark.info/dXNlcg/\r\nserver: BitNinja-WafPro\r\nvia: 1.1 Caddy\r\nx-powered-by: PleskLin\r\ncontent-length: 301\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T00:48:29.776235Z","times_seen":18608930,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"play2information.com/WsvKPLzZb/infoclient/mXKgmrdz/","fqdn":"play2information.com","domain":"play2information.com","tld":"com"},"ip":{"addr":"66.235.200.147","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-17T03:41:54.605Z","timestamp":1789616514605,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"play2information.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 15 Sep 2026 01:10:30 GMT","end":"Mon, 14 Dec 2026 02:10:21 GMT"},"fingerprint":{"sha1":"D2:CE:A1:31:7B:56:B8:AD:A8:04:B9:E0:EA:78:F4:15:77:EE:29:B8","sha256":"C5:8E:33:D4:A3:D6:D2:0C:3D:26:3B:C6:56:7A:D0:70:18:6C:B0:81:6A:0A:36:5F:2C:0B:CA:49:05:D8:97:0C"}}},"request":{"raw":"GET /WsvKPLzZb/infoclient/mXKgmrdz/ HTTP/1.1\r\nHost: play2information.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://304shark.info/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 17 Sep 2026 03:41:55 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\nhost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==\r\nserver: cloudflare\r\nset-cookie: PHPSESSID=252702dcd388b02af297291f4472e78e; path=/\n__cf_bm=nFDvE07BQzQc77zQ9vGq6gp.24xwZNGdR3XneJK3_YY-1789616514.7190652-1.0.1.1-iXy2tARY1nT6mXrJH18gVSgzAq1KX9mLqTDFcESprCIaqFWCxoW.9Q1xMv6MOgJOX8GSwLIK.k35Ifq.G6.0KucQnCGhQTR5qbsU03kyPumgr0ltl_6TLz4kNGv8zQuH; HttpOnly; SameSite=None; Secure; Path=/; Domain=play2information.com; Expires=Thu, 17 Sep 2026 04:11:55 GMT\r\ncf-cache-status: BYPASS\r\ncontent-encoding: gzip\r\ncf-ray: a3c51910ff5723eb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"252702dcd388b02af297291f4472e78e","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=252702dcd388b02af297291f4472e78e; path=/"},{"name":"__cf_bm","value":"nFDvE07BQzQc77zQ9vGq6gp.24xwZNGdR3XneJK3_YY-1789616514.7190652-1.0.1.1-iXy2tARY1nT6mXrJH18gVSgzAq1KX9mLqTDFcESprCIaqFWCxoW.9Q1xMv6MOgJOX8GSwLIK.k35Ifq.G6.0KucQnCGhQTR5qbsU03kyPumgr0ltl_6TLz4kNGv8zQuH","quoted":false,"path":"/","domain":"play2information.com","expires":"2026-09-17T04:11:55Z","raw_expires":"Thu, 17 Sep 2026 04:11:55 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=nFDvE07BQzQc77zQ9vGq6gp.24xwZNGdR3XneJK3_YY-1789616514.7190652-1.0.1.1-iXy2tARY1nT6mXrJH18gVSgzAq1KX9mLqTDFcESprCIaqFWCxoW.9Q1xMv6MOgJOX8GSwLIK.k35Ifq.G6.0KucQnCGhQTR5qbsU03kyPumgr0ltl_6TLz4kNGv8zQuH; HttpOnly; SameSite=None; Secure; Path=/; Domain=play2information.com; Expires=Thu, 17 Sep 2026 04:11:55 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bluehost","description":"Bluehost is a large web host known for its WordPress expertise, variety of “one-stop-shop” services, and bargain prices.","website":"https://www.bluehost.com","common_platform_enumeration":"","icon":"Bluehost.svg","categories":["Hosting"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":663826,"size_decoded":365696,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (38605)","md5":"be859e5ba73e679adcc59951298eff0b","sha1":"1307b54b6d0707bec8e49170f576f027b1cc3325","sha256":"6b97e702421376cbc5a3d65b82eeefa48202dd657cafc89ba64fb9abb4ce9b64","sha512":"76b5e9a65bf7dbbd0d1b2682fe3d759a4e2a83d2b9c76e8077f17bf588863b4ded565fb1b18dd20b11564357a3ebd1ed4456b876ae12bd6601de11b78e6a9bdb","ssdeep":"12288:B0gCr0trMus838vKLGCew1dsu4VGRhe8cm7e58zhYxDVW5YXe3TV3Q7lwZH9a12S:BVMus8QKCCh+TyheHX589OM5Y0TV3Q7x","tlshash":"61e4ae338e1b2e562b783a6646df2ace2d1ce3c7648289c4b4dd1a90df5db4534c639c","first_seen":"2026-09-17T03:42:28.512014Z","last_seen":"2026-09-17T03:42:28.512014Z","times_seen":1,"resource_available":true,"data":null}},"time_used":488,"timings":{"blocked":-1,"dns":95,"connect":1,"send":0,"wait":376,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - SwissPass","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with SwissPass phishing","tags":["swisspass","phishing","transport"],"meta":null}]}},{"url":{"schema":"https","addr":"304shark.info/favicon.ico","fqdn":"304shark.info","domain":"304shark.info","tld":"info"},"ip":{"addr":"194.30.191.151","port":60413,"asn":8447,"as":"Telekom Austria","country":"Austria","country_code":"AT"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://304shark.info/dXNlcg/","date":"2026-09-17T03:41:54.717Z","timestamp":1789616514717,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"304shark.info","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 09 Sep 2026 03:21:24 GMT","end":"Tue, 08 Dec 2026 03:21:23 GMT"},"fingerprint":{"sha1":"7F:83:1E:0F:34:F7:2D:B1:31:F3:19:9D:B4:2D:5D:17:FD:3D:96:5F","sha256":"17:BA:23:DE:F3:8E:20:6E:17:53:C8:95:2D:B2:B5:2B:CB:44:03:D8:50:73:FB:0B:35:33:08:24:D0:90:B1:A4"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 304shark.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://304shark.info/dXNlcg/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvary: Accept-Encoding\r\ndate: Thu, 17 Sep 2026 03:41:54 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-encoding: gzip\r\nlast-modified: Tue, 11 Nov 2014 16:04:32 GMT\r\nserver: BitNinja-WafPro\r\netag: \"54623390-4486-gzip\"\r\nx-powered-by: PleskLin\r\nalt-svc: h3=\":443\"; ma=2592000\r\nvia: 1.1 Caddy\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":17542,"size_decoded":4436,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"1ce0c63f8bd1e5d3376ec0ae95a41c08","sha1":"5b3e716a5add8b7e0fb106f8c45e19c1d73c5e39","sha256":"b57d38ae105fe112a7ed00c176c935c46c77761bae33f023d4fda72450043607","sha512":"a12cf9292dee1f19acfe51a33aeafb7af70d704e9f62caa7ac77c396e4949ba74f3494e7c9f4d3af374d28a1c23ecc03ecf17b0327fba8701fc20f5ea2255430","ssdeep":"192:FeeI+2600HTpdZuw8Zd0BaJkYsshIa50kbiQ7Q5T:FeeIKpd78ZmIJkYsshIa55+QcJ","tlshash":"08728885c220804fdafd4ef2b87fb1b061f1b4acbcb9d45896689f0e545cbd0d4ad668","first_seen":"2023-04-05T09:18:00Z","last_seen":"2026-09-20T14:11:55.397682Z","times_seen":577,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-17","alert":"Sinkholed","trigger":"304shark.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}