{"report_id":"88cb13cb-d861-470f-ae1c-1ee5fdd8ca79","version":0,"status":"done","tags":[],"date":"2026-07-04T14:05:11Z","url":{"schema":"https","addr":"mobil-tr-girisler.vip/","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"mobil-tr-girisler.vip/","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"title":"Marsbahis - Güvenilir ve Kazançlı Bahis Deneyimi","dom":{"size":48911,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1042)","md5":"e5518726eb11b17ff92261e66be16c87","sha1":"76ac0dd78acceb4e96cd1eba08ac66f6a5dd3a8d","sha256":"7d6117edea606c28530eada9b692b246dc3e738900f1ac0639662041a8db4dbd","sha512":"47a3c6a75b37e912e5f536480ceaf61cdd8014b7493b2ebc9d79d675942d585ba72c7408dc0499a55e18dd2103609c18dc0805b5d849f397ab4f6de15e2749aa","ssdeep":"384:QNSJvEIQeYMF8cCDGB+7vuXGsJ5187epogc8CXQTCVXzzbIEIL6fwWGi+7Hnq/cA:PCDGsjKbc8gQmVjzoGwWGdb1n9Fx/+","tlshash":"d4239455a6f284362513e69466e7271b3f62f003ce3edd153acc12d88fcdae5a81368c","dom_hash":"domhashad9fb203da1a872aa7bfbc32d928d0ed","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"mobil-tr-girisler.vip/","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-08T14:05:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"marsbahis.mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"marsbahis.mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"mobil-tr-girisler.vip","ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-02","domain_rank":0,"first_seen":"2026-07-03T15:13:13.315643Z","last_seen":"2026-07-03T15:13:13.315643Z","alert_count":8,"request_count":4,"received_data":74440,"sent_data":2043,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}]},{"fqdn":"marsbahis.mobil-tr-girisler.vip","ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-07-02","domain_rank":0,"first_seen":"2026-07-03T15:18:19.449583Z","last_seen":"2026-07-03T15:18:19.449583Z","alert_count":4,"request_count":2,"received_data":43029,"sent_data":1067,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-06-28T22:47:06.167692Z","alert_count":0,"request_count":3,"received_data":374054,"sent_data":1741,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-06-28T22:22:13.875484Z","alert_count":0,"request_count":1,"received_data":21764,"sent_data":574,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"0b8b4bc5bb7d8c74bbd113e9b40390e0","sha1":"ea602cc5d0c28fb9541fca75da645ff57dac737b","sha256":"e1a2aa15434a5ce440a9e2be003e4c2e29990e45df32edd168524ced0c0d19b3","sha512":"191a0e2cdc4610a09d8a6a28c7e01827dbab4d08b7dc03d70b70673d3f09991c8c86855cc42ff6d6fab584b037ccd7e18286018f05d109ac136dfc148d84df41","ssdeep":"","tlshash":"f2d023551979883071ac014720f9d3e8267130d477116700c1c8dc2f6f30dd304f759c","size":217,"data":"","first_seen":"2026-07-04T14:05:12.821343Z","last_seen":"2026-07-04T14:05:12.821343Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mobil-tr-girisler.vip/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bca3d4a1ba4d6b15066b2eef2452ee34","sha1":"51528ee54bd8415afe02e89a904aed5069fc14b7","sha256":"823809c23a6335f0c6d208589b64e80c2149502e0dd305691cb994d2083bbc88","sha512":"3e5f50b77c13bc56a769a0b3d6dda48e0edc98130dba1a36726bade0b7d5bd30c107f58e1d713068aa86afb2ec28949754622ed4228d1ec0507040c6f674a358","ssdeep":"384:BexKUidh2iVObnzuGUFOUb98gLzuWwiBRTyOMpEyZts6G3TgDU2loT4:BexdTNQsWu4SWN4pEy2TgDys","tlshash":"5ca284db7cccb85aa7c66231423b3cdff12a9f445018465dc711d7e87da536e422b988","size":21481,"data":"","first_seen":"2026-07-04T13:40:41.0814Z","last_seen":"2026-07-04T14:05:12.816983Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mobil-tr-girisler.vip/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.754Z","timestamp":1783173887754,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mobil-tr-girisler.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 23:12:53 GMT","end":"Wed, 30 Sep 2026 00:11:36 GMT"},"fingerprint":{"sha1":"78:87:34:37:3E:3C:85:C7:20:B3:70:BA:4F:D1:77:7A:21:04:35:83","sha256":"B5:37:0E:1E:AE:62:DE:82:2E:B4:29:E4:10:D2:C8:29:35:A0:09:FE:41:7F:06:D9:0E:32:63:0A:2D:DB:6D:09"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: mobil-tr-girisler.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 \r\nlocation: /cdn-cgi/challenge-platform/h/b/scripts/jsd/80a697ecdece/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\nserver-timing: cfExtPri\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a15eae5e7c0d7131-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T12:40:26.815973Z","times_seen":17314312,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marsbahis.mobil-tr-girisler.vip/apple-touch-icon.png","fqdn":"marsbahis.mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.788Z","timestamp":1783173887788,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mobil-tr-girisler.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 23:12:53 GMT","end":"Wed, 30 Sep 2026 00:11:36 GMT"},"fingerprint":{"sha1":"78:87:34:37:3E:3C:85:C7:20:B3:70:BA:4F:D1:77:7A:21:04:35:83","sha256":"B5:37:0E:1E:AE:62:DE:82:2E:B4:29:E4:10:D2:C8:29:35:A0:09:FE:41:7F:06:D9:0E:32:63:0A:2D:DB:6D:09"}}},"request":{"raw":"GET /apple-touch-icon.png HTTP/1.1\r\nHost: marsbahis.mobil-tr-girisler.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mobil-tr-girisler.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Fri, 10 Jul 2026 15:17:56 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 02 Jul 2026 00:47:18 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\nage: 82011\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BhYEq8K867PvAJLOOoTdSRwAaYo43ApIWHzpW6Ld%2F0cTYm9WcWsl2zJTPfTV7YOdvZTgCsl7cMcnAc%2FzUl7F3jw2DGWyMzTeHPUgg1POZ36AUgNjQdx2YXuMELxJ0F7rFSCxD59RqmeR5Fnqaa7cMkPh\"}]}\r\ncf-ray: a15eae5ebc137131-OSL\r\ncontent-length: 41542\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":41542,"size_decoded":42320,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"a1909eba20e0cafc34a8e5f9ffcf2ca6","sha1":"e94d3c9f7fd1c9ad5b3ca6c7f8ad3ddd94d6e31b","sha256":"528d61939943a7016147f9a253c1a7e7eb2376cb47a7748af8054fc904ac36c5","sha512":"37d2be09f6cda89f15422f040bc0824aa1f31a2a09e76cdcf110614ba977134b1511e41a1791783d3921c7dd73e0ad30d649066c1cf69bc1a8f74d4424b89526","ssdeep":"768:JRgRxnf7izyOLjlPS3yp7JkyNcPrdw8lqi3pUhsK7rNQXaQG:n8xDi+4PSi7l85wcp/KeXaQG","tlshash":"0813f2c0d500b219b73e0b240084094fefdd8943e126adf569bdeaeea15688dbed9374","first_seen":"2026-07-03T15:04:33.554535Z","last_seen":"2026-07-04T14:05:13.626877Z","times_seen":1245,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":6,"connect":4,"send":0,"wait":11,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"marsbahis.mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"marsbahis.mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"marsbahis.mobil-tr-girisler.vip/favicon-16x16.png","fqdn":"marsbahis.mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.790Z","timestamp":1783173887790,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mobil-tr-girisler.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 23:12:53 GMT","end":"Wed, 30 Sep 2026 00:11:36 GMT"},"fingerprint":{"sha1":"78:87:34:37:3E:3C:85:C7:20:B3:70:BA:4F:D1:77:7A:21:04:35:83","sha256":"B5:37:0E:1E:AE:62:DE:82:2E:B4:29:E4:10:D2:C8:29:35:A0:09:FE:41:7F:06:D9:0E:32:63:0A:2D:DB:6D:09"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: marsbahis.mobil-tr-girisler.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mobil-tr-girisler.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: BYPASS\r\npriority: u=6,i=?0\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NBlDulVCs05szmfqbxMoMGQY3UTj%2BUOu1YYILFWVDABC0iXGUO9ClhX9WqjK4N3dJ3td1e4FrYGtVGpeJ3mxnV6t3mbrtNbU3TaqL7trWtQOVYPpoj83DkG0vUU7uaphtNCJowNFWAT5eOOqwQM7ug7V\"}]}\r\ncf-ray: a15eae5ebc127131-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T12:40:26.815973Z","times_seen":17314312,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"marsbahis.mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"marsbahis.mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mobil-tr-girisler.vip/cdn-cgi/challenge-platform/h/b/scripts/jsd/80a697ecdece/main.js?","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.793Z","timestamp":1783173887793,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mobil-tr-girisler.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 23:12:53 GMT","end":"Wed, 30 Sep 2026 00:11:36 GMT"},"fingerprint":{"sha1":"78:87:34:37:3E:3C:85:C7:20:B3:70:BA:4F:D1:77:7A:21:04:35:83","sha256":"B5:37:0E:1E:AE:62:DE:82:2E:B4:29:E4:10:D2:C8:29:35:A0:09:FE:41:7F:06:D9:0E:32:63:0A:2D:DB:6D:09"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/80a697ecdece/main.js? HTTP/1.1\r\nHost: mobil-tr-girisler.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\ncontent-encoding: zstd\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-ray: a15eae5ebc117131-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21481,"size_decoded":10352,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (21481), with no line terminators","md5":"bca3d4a1ba4d6b15066b2eef2452ee34","sha1":"51528ee54bd8415afe02e89a904aed5069fc14b7","sha256":"823809c23a6335f0c6d208589b64e80c2149502e0dd305691cb994d2083bbc88","sha512":"3e5f50b77c13bc56a769a0b3d6dda48e0edc98130dba1a36726bade0b7d5bd30c107f58e1d713068aa86afb2ec28949754622ed4228d1ec0507040c6f674a358","ssdeep":"384:BexKUidh2iVObnzuGUFOUb98gLzuWwiBRTyOMpEyZts6G3TgDU2loT4:BexdTNQsWu4SWN4pEy2TgDys","tlshash":"5ca284db7cccb85aa7c66231423b3cdff12a9f445018465dc711d7e87da536e422b988","first_seen":"2026-07-04T13:40:41.0814Z","last_seen":"2026-07-04T14:05:12.816983Z","times_seen":3,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.6.0/css/all.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.522Z","timestamp":1783173887522,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/@fortawesome/fontawesome-free@6.6.0/css/all.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://mobil-tr-girisler.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 6.6.0\r\nx-jsd-version-type: version\r\netag: W/\"17906-PHP/HNe5fBifE5Nn26xD3PXSxw0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nage: 264315\r\nx-served-by: cache-fra-etou8220169-FRA, cache-bma-essb1270051-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 23158\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96518,"size_decoded":23938,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (58966)","md5":"fbf1f3445f2554bce753c92cf6851b41","sha1":"3c73ff1cd7b97c189f139367dbac43dcf5d2c70d","sha256":"e5e202e3c899507992952533f57b634722b69b34241d271963559d31aa33ef81","sha512":"29cdf6def18112acd39a8b801029d571ec90ab2a9db128aa2d021204bdbd6945b853f33ba523c0fe0114650aafd5cc31e0e9d8c53c6f7b950c839193e8be0926","ssdeep":"1536:E6M1MvMaMfMRQk709/bQZMfjSFOlyPG9dXgRw0J:H709/UGGFwyPG9dwRw0J","tlshash":"559373f8e44c05d97732c44bab55b37c65b6f738d5810ca9f02f590c2ad26a822caf79","first_seen":"2024-07-20T00:27:59Z","last_seen":"2026-07-17T12:24:28.091591Z","times_seen":15986,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":5,"connect":10,"send":0,"wait":11,"receive":5,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.6.0/webfonts/fa-solid-900.woff2","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.735Z","timestamp":1783173887735,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/@fortawesome/fontawesome-free@6.6.0/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://mobil-tr-girisler.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.6.0/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: font/woff2\r\nx-jsd-version: 6.6.0\r\nx-jsd-version-type: version\r\netag: W/\"26608-aTNc1qasgiU+pVRYmczN41rzkTE\"\r\naccept-ranges: bytes\r\nage: 170829\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nx-served-by: cache-fra-eddf8230099-FRA, cache-bma-essb1270051-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 157192\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":157192,"size_decoded":157938,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 157192, version 774.256","md5":"237f4a0afbdb652fb2330ee7e1567dd3","sha1":"69335cd6a6ac82253ea5545899cccde35af39131","sha256":"1f0189e087fcefbf654fad74a3a06668b782c01353a61d5c0b7f0bf23e33c020","sha512":"27e8e1f91507179c207f93a19485738ed5d372a977eb27d44a4ed163013097d38b117c7a5bf4336ecc9862ca514d78ffcd2b8a07e304bbfe1b2cce9c087baa38","ssdeep":"3072:Qeqp46DjdHdb7UT/IGFc27+78oGmfIXe0pGRDH9tQm1pbYqup:Q16n/IqpoG2IXZYTtxrbdO","tlshash":"5ce3125bf5e6dbe5525e6d64fb5478972b1030823ee11cf12ce2206eb889317399e08f","first_seen":"2024-07-18T18:39:32Z","last_seen":"2026-07-17T12:49:08.871252Z","times_seen":18120,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mobil-tr-girisler.vip/cdn-cgi/challenge-platform/h/b/jsd/oneshot/80a697ecdece/0.256282168284486:1783170327:ZV0F3dAAA6VQ3RDYLfh4FDrN6nLgMfy-jRgqSBPrtZc/a15eae581bd57131","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.920Z","timestamp":1783173887920,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mobil-tr-girisler.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 23:12:53 GMT","end":"Wed, 30 Sep 2026 00:11:36 GMT"},"fingerprint":{"sha1":"78:87:34:37:3E:3C:85:C7:20:B3:70:BA:4F:D1:77:7A:21:04:35:83","sha256":"B5:37:0E:1E:AE:62:DE:82:2E:B4:29:E4:10:D2:C8:29:35:A0:09:FE:41:7F:06:D9:0E:32:63:0A:2D:DB:6D:09"}}},"request":{"raw":"POST /cdn-cgi/challenge-platform/h/b/jsd/oneshot/80a697ecdece/0.256282168284486:1783170327:ZV0F3dAAA6VQ3RDYLfh4FDrN6nLgMfy-jRgqSBPrtZc/a15eae581bd57131 HTTP/1.1\r\nHost: mobil-tr-girisler.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 13838\r\nOrigin: https://mobil-tr-girisler.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mobil-tr-girisler.vip/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/plain; charset=UTF-8\r\ncf-chl-out-s: IJgCMWZdeRoz3KSiu/CqDFH2fAVw6H9vlyW9fyLgGXtvLg9HHCISPpT9qRJLYp0sMj6NsS4fH5t7OXRnxmnQqFQRSkR+JQLwdZtFiumM/i1Eyfw2RcFlsNiv9hIWLZC0x6+Eby3e1lKUo1d9MlBOeAg7dgABRU78ooFICGFGq+ClxUSZgewichgRJtLuJAe9LEgQCxrzCKjh9eP3O09gj4Iw9NlV12pVoGddbONmXRI2G/DgWxbm+K5x5RVKv5tEu1N3S5YXaURoDTDiPq49Og==$9YdfiO92Wok44d1W15ECBg==\r\nset-cookie: cf_clearance=SuqHAUIxwIk2sSd5tU6UvHnBDuES..5YrdLUDPrkXYY-1783173887-1.2.1.1-za.0rfGVatpJc7zg6oh3tPJ2ZU4bWHgbxk_ma71w39QiSli2igH_VGs.sYD.cqxO1cwPTaUis9WXVQe.47Loom2wAXoHqYaMHImpY0FNGkSU7nDtu7_RItlkxYsrZeoqT59tigq3Ulki.Iuae_GBrudftPBXnAnSYRFx7a20eWAIxV1F8iR4b.gOksOx7DB0tXd1vHWY2.wIPXWCafwBRdZlKQ72A8LoopsBRUp79Da8LsWTCN0.Lf_XfTwaVUNBg.g6z0eJBIcqJoG1eEk1W8tSlADqcqtQx2lPJd.9BZiuLCJXEC.Un2OQ_WvuAi9dD_.tCl.W0D6inGXY2mOuyQ; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=mobil-tr-girisler.vip; Expires=Sun, 04 Jul 2027 14:04:47 GMT\r\ntiming-allow-origin: https://mobil-tr-girisler.vip\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nserver-timing: cfExtPri\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a15eae5f8c277131-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":15674,"mime_type":"text/plain; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T12:40:26.815973Z","times_seen":17314312,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mobil-tr-girisler.vip/","fqdn":"mobil-tr-girisler.vip","domain":"mobil-tr-girisler.vip","tld":"vip"},"ip":{"addr":"104.21.44.141","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-04T14:04:46.708Z","timestamp":1783173886708,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mobil-tr-girisler.vip","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 23:12:53 GMT","end":"Wed, 30 Sep 2026 00:11:36 GMT"},"fingerprint":{"sha1":"78:87:34:37:3E:3C:85:C7:20:B3:70:BA:4F:D1:77:7A:21:04:35:83","sha256":"B5:37:0E:1E:AE:62:DE:82:2E:B4:29:E4:10:D2:C8:29:35:A0:09:FE:41:7F:06:D9:0E:32:63:0A:2D:DB:6D:09"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mobil-tr-girisler.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aukI7y95H3%2FASbt7AKBsX7BjbaxMEJ%2BL388V30OgkSbAXh4cnNssmLbzQ93mjZmm3Sh4NL%2BF%2BLTpDj3z0HKLtC%2FLbOmHTsO%2F%2FomZaH0ZdKyS4GEeYuMefFyQyRSn1CtmuexGk7sNUBU%3D\"}]}\r\npriority: u=0,i\r\nvary: Accept-Encoding\r\ndate: Sat, 04 Jul 2026 14:04:46 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\ncf-ray: a15eae581bd57131-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50367,"size_decoded":11027,"mime_type":"text/html; charset=UTF-8","magic":"Generic INItialization configuration []","md5":"0f846f6f23d78d80afcfc9a596e9c398","sha1":"4639fb21b2f9435084c02d1afb28d0583b144114","sha256":"9c0107685e67af4b5234c963ec7f34fee8e49c86a0e810d178d971fd9150dc60","sha512":"855ae04e5920ce26670eb4833da2a5e5754868c88c0428058be5162d5982ffe82b764840a8aa9e0d32856b33d42a239bf43df95135ec89cb5f1c376c69dc51f4","ssdeep":"384:DfOfxQW+csQDQoIfGN+7RYHdU9VEhWHpEBHOfpeT7TkHb1jG8JqYPG/+7b+DcCn8:GIfG4lBwH8pW7QHc1YPGmPQnyx//","tlshash":"2033415192c098362137e3989be2575aff92e113cb3a961536ec53cb4ff9960a403ecd","first_seen":"2026-07-04T14:05:12.818982Z","last_seen":"2026-07-04T14:05:12.818982Z","times_seen":1,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":3,"connect":14,"send":0,"wait":172,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"mobil-tr-girisler.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Rubik:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,400\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.519Z","timestamp":1783173887519,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 08:41:02 GMT","end":"Mon, 07 Sep 2026 08:41:01 GMT"},"fingerprint":{"sha1":"FD:DA:E1:3E:1F:AC:E0:96:14:ED:37:58:30:0F:ED:9D:B4:5E:F1:EF","sha256":"7D:36:0C:A4:14:F6:05:8D:F4:E1:CD:BF:84:A7:03:AD:3F:C4:93:AE:B3:D6:7E:99:CB:92:D7:1F:29:A1:49:A4"}}},"request":{"raw":"GET /css2?family=Rubik:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,400\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mobil-tr-girisler.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 04 Jul 2026 14:04:47 GMT\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21080,"size_decoded":1795,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (649)","md5":"db6852277af4bdd207084f26201db625","sha1":"2fee8ea218412630c1ed11fc5d5aac3290b59578","sha256":"94b6aafbdcbf81c7c1ed2a8c3cd74d546e38dff631b541d9c583dd1ad690b181","sha512":"83332c84e91a66afb8ef608791ff84f9619f01919d75916d003640c0569e46aaa262960d5eaf34b2f3fe06e90af60ad30d907689969be0fba663b51d7e7413d5","ssdeep":"192:jONClkOjsO6OsOVGOKhClRsprgAHThCl8s0KtAuMhClDsb5uAt1hClGs+ALAkWh1:jRlkistbDslSOlHRlgwltLlealTNlMz","tlshash":"4692aae1481e5040bf472cc263ce6d37ee0e62553490c56d9bfd1a9aacabc2233657ce","first_seen":"2025-10-16T18:09:47.317013Z","last_seen":"2026-07-04T14:05:13.627651Z","times_seen":1255,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":0,"connect":19,"send":0,"wait":32,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.6.0/webfonts/fa-brands-400.woff2","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mobil-tr-girisler.vip/","date":"2026-07-04T14:04:47.737Z","timestamp":1783173887737,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/@fortawesome/fontawesome-free@6.6.0/webfonts/fa-brands-400.woff2 HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://mobil-tr-girisler.vip\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.6.0/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: font/woff2\r\nx-jsd-version: 6.6.0\r\nx-jsd-version-type: version\r\netag: W/\"1cd38-6UgpB3MhbcG1DCEhMUqM+RjCK1Q\"\r\naccept-ranges: bytes\r\ndate: Sat, 04 Jul 2026 14:04:47 GMT\r\nage: 170829\r\nx-served-by: cache-fra-eddf8230043-FRA, cache-bma-essb1270051-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 118072\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":118072,"size_decoded":118818,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 118072, version 774.256","md5":"715d593456fa02fe72a008a72398f5be","sha1":"e948290773216dc1b50c2121314a8cf918c22b54","sha256":"c411f11975d26eb04cd2aa3c071181d4b18e489f1fb97060d4176a3531dfb36e","sha512":"1f63209c93a462c2690442c9cf1c3e5a67f2df7a67dfcda2cb81292a2dbb90641aa0ab81c25323a1f2d9f0fa09b3421d136ae5228c47e581c51912ba284de46e","ssdeep":"3072:3wqMZaMDlYfb+t0YI4WlLL7rE2ZjX+B+pdJpimtm:gpZNYfytUxH7rnZj+Szpiz","tlshash":"71b3137922e526408e9d0e3bbf7b6a6ec7f8719ddbd4c10aa7d18469001738ed8d842c","first_seen":"2024-07-20T13:53:50Z","last_seen":"2026-07-17T12:52:56.372524Z","times_seen":12999,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}