{"report_id":"9ddbdb3c-be7c-451a-b91a-a7e9b0f0f605","version":0,"status":"done","tags":[],"date":"2026-08-09T10:00:33Z","url":{"schema":"http","addr":"pu.biolyroa.com/","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":0,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"pu.biolyroa.com/7676b98d-ed1a-4f5d-8158-6ada6b7c6ed5","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"title":"Sign in - Professional Email","dom":{"size":46057,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (563)","md5":"b12c0897000ef342ea57344a4642f568","sha1":"8d0a19e77e349eb17fad21aba2310661a343cfef","sha256":"cc9778668cbc349cc82421632e39f5bffb516d6ae09febb9025f8d85db43bcf1","sha512":"175fe4f7e30f9e893fed3055635e9fdd803b4862c568c47df98e2414d9c9a0c505ac74d35077051d1a8d6438cd702c7dc170d0803e737612b53ef1440ddd0b87","ssdeep":"384:Y1qbuDBm/Zm08OVElu/egEUCL8G8+bkce0uvbY0blbuDBm/Zm08OVVRHe6DCnSXG:SE65bDEVRHe6DCnU5bZMbGqaNn4B","tlshash":"0123886e94a5141662134ec437d569243a52d0078c86fdfcbabec2c88fe1e936c5f35e","dom_hash":"domhash715ea3c6c32b2829b3c688bd3855f538","first_seen":"2026-08-09T01:32:12.609615Z","last_seen":"2026-08-09T10:00:33.865971Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pu.biolyroa.com/","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":0,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-13T10:00:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-08-09","alert":"Detects hex encoded code that has been base64 encoded","trigger":"pu.biolyroa.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2019-04-29","description":"Detects hex encoded code that has been base64 encoded","reference":"https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/","rule":"SUSP_Base64_Encoded_Hex_Encoded_Code","score":"65"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"pu.biolyroa.com","ip":{"addr":"77.68.67.156","port":443,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-07-26","domain_rank":0,"first_seen":"2026-08-09T01:32:09.149599Z","last_seen":"2026-08-09T01:32:09.149599Z","alert_count":7,"request_count":2,"received_data":303891,"sent_data":990,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"webmail-oxcs.networksolutionsemail.com","ip":{"addr":"198.251.71.220","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"domain_registered":"2003-01-09","domain_rank":671255,"first_seen":"2021-11-09T02:11:21Z","last_seen":"2026-08-05T18:16:02.277801Z","alert_count":0,"request_count":1,"received_data":453,"sent_data":553,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"mxhdjr.com","ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2026-06-09","domain_rank":0,"first_seen":"2026-06-15T11:59:34.268716Z","last_seen":"2026-08-03T08:02:28.181337Z","alert_count":0,"request_count":5,"received_data":369145,"sent_data":2487,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"pu.biolyroa.com","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":443,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"b90841c83f39b951aab8d9f879b6d0b4","sha1":"d5d324d80679c062bf800c6a289f403566e2fa8c","sha256":"7c675fd9f02936e5ef76ca7aaebb52b2439a84c7f48af4437be7d44489313ff0","sha512":"eb642808b6171fb95cdb5aaaea6be26da7556fc52e2f07af6d411906c7319c52f7d1ff9be8460a78920becc094d5ad4c058b6a53531253d9419ba4a3f40131b1","ssdeep":"","tlshash":"e811ef6d59665838651346f3319526833513481b9c44326a75af53082f8948df2b6afa","size":858,"data":"","first_seen":"2026-08-09T01:32:12.616725Z","last_seen":"2026-08-09T10:00:33.884424Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pu.biolyroa.com","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":443,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"6ac84336361fe18c2553f7d213cbf4ca","sha1":"a1e7abc957028fcbd1f19eb081c926363fea60fb","sha256":"b34821404824e6b6b4fce76dbb5ec398dd8a64ebfc453f4fcb77aaaba147476d","sha512":"b99ab915dab93fe97e3192c49812dcaf5747a120449d7476275f32a98a1d82dbfb156c384c1601a3cbf6a55b264dfebdd8bdeae70964c995384e3244eac8f5aa","ssdeep":"96:b2i3MJzZSDEOMhA+uOGkvanoH4EHp3rZCORnbDPWemu+HIrY89LVl+9nPGyyyA4q:Yz2Mh2AvanoYq3UORvUlojfl+9nOyy37","tlshash":"a5b1700d64e310b11b63a0bab3efa10931b141272d07ca643d1d874d5fa4c6b6ef5bda","size":5507,"data":"","first_seen":"2026-08-09T01:32:12.617914Z","last_seen":"2026-08-09T10:00:33.886256Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pu.biolyroa.com/7676b98d-ed1a-4f5d-8158-6ada6b7c6ed5","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":443,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"abe34546d98a1203e51ae597398b6448","sha1":"314cf3737c6b3e25d76bc6ea4ce6f746d8a97491","sha256":"515da00209e68a25e2d79a4fc9a623b76634b7a745ba7330fc22c79452665e99","sha512":"757cdfd9cedb4027e684b0b352304457e6c158ccc76a6fc8d0bb80c45f980972e258a0c3c9d2742e7fbb352b7eae1326c9d31f5655585b75c5c1f3d171693884","ssdeep":"3072:ExqVE2FHO4W0ScxOApMtCdIm/cs1Jp+1wel30F+4PiHz5vo:EcHFHO4NnxA15vo","tlshash":"3c24a1797418abda004e56e3ae25b0b09bd17ab37065c3ecfb40ad3834dd636dc68634","size":223611,"data":"","first_seen":"2026-08-09T01:32:12.615217Z","last_seen":"2026-08-09T10:00:33.887622Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pu.biolyroa.com","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":443,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"9aa5acf0809feec17f49c5a767e77109","sha1":"2b442beae58032fd108164a458f410ab26f508a6","sha256":"d9682ed531e3afbd53399c4236ebba63fb82aa0c858d460751f7e303024696bb","sha512":"363d10f59b3418aa44120013525f09d704218429fbe5eb1905c7d2dedb2569dc275ec838c9b67e7104ab388037e19e3a30b91ff8c917be41dd22ea0cd8212876","ssdeep":"","tlshash":"d2c012ca4d46144642d22312598330641472d1ff1398a40779586e012b6975c1a16b84","size":179,"data":"","first_seen":"2023-03-14T05:05:51Z","last_seen":"2026-08-09T10:00:33.889572Z","times_seen":3157,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"HTML Injector Loaded - Mode: full","filename":"blob:https://pu.biolyroa.com/7676b98d-ed1a-4f5d-8158-6ada6b7c6ed5","line_number":19,"column_number":87876},{"level":"warn","text":"Failed:https://mxhdjr.com/app/networksolu/media/index.html.js.download","filename":"blob:https://pu.biolyroa.com/7676b98d-ed1a-4f5d-8158-6ada6b7c6ed5","line_number":19,"column_number":89668}]},"http":[{"url":{"schema":"https","addr":"mxhdjr.com/app/networksolu/media/logo_180.png","fqdn":"mxhdjr.com","domain":"mxhdjr.com","tld":"com"},"ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pu.biolyroa.com/","date":"2026-08-09T10:00:07.641Z","timestamp":1786269607641,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mxhdjr.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:BD:B0:D9:CB:F8:4F:8D:5E:D9:9F:24:21:53:47:60:18:E3:8F:05","sha256":"B3:DB:A7:27:FC:BF:16:F1:AC:25:6C:ED:B8:77:DC:3F:6F:30:32:76:36:CF:33:1F:39:69:71:48:8F:10:17:46"}}},"request":{"raw":"GET /app/networksolu/media/logo_180.png HTTP/1.1\r\nHost: mxhdjr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 16 Aug 2026 10:00:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 06 Jun 2025 21:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-length: 15754\r\ndate: Sun, 09 Aug 2026 10:00:07 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":15754,"size_decoded":16040,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e06af44c8daf198f8f7347c19d16b6fb","sha1":"5f19c6b1810c23b4c00c47ab9ab69ac2fe616954","sha256":"bf4d6827f36f12aaf4e420da28f3ee7b6335be06a13aa3b54bc67eaa4f6465ae","sha512":"74936fb186b6e01e294908c74828055ad9e4c46f5a467eb1f89afae9191245ec93c078054803f706bda3b4463e143aba9b9f6a91409662420b968e258121d9a6","ssdeep":"384:is8kUKBoDqINe3wDrYojG3eyVyH4rd4nlWUsFP:itNKBolUoqey0H4rd4lW/P","tlshash":"ae62d0d8eac7dfcaa6fddc43951c91230af6c912de7d1a012bd01b5800778979b5592c","first_seen":"2023-05-03T20:03:27Z","last_seen":"2026-08-09T10:00:33.86944Z","times_seen":1909,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pu.biolyroa.com/","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":443,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T10:00:06.154Z","timestamp":1786269606154,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pu.biolyroa.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 03 Aug 2026 17:20:32 GMT","end":"Sun, 01 Nov 2026 17:20:31 GMT"},"fingerprint":{"sha1":"62:09:28:F0:A2:BA:F3:B6:9B:0E:C7:F9:2B:7A:02:6C:BF:D0:64:CD","sha256":"56:D4:AF:EB:98:B1:58:AF:60:61:05:8B:2A:83:E0:EA:8E:7B:B8:78:06:61:70:51:45:73:0D:6D:8B:B7:B3:3A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: pu.biolyroa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 09 Aug 2026 10:00:06 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 07 Aug 2026 15:51:34 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 303646\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":303646,"size_decoded":303891,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (65244), with CRLF line terminators","md5":"62aa050707e81d60a23c309f8f757b43","sha1":"a62d873120badd360d033303fbba1a58ec47f2b9","sha256":"90c7a5dc8bf995efb5c776e8fe4579cbcf9b2f63c59d68dd8e5854eb6218bdf0","sha512":"04074194f890b4dc173cf6f3a2bbaf0fcab80c9d4a4351b5482fb441d428c3aacf581902794c662cddb6db279b4be6a24a2f58273581909d86b436cc4d86e1c5","ssdeep":"6144:+gv7SOTEyMAPmhHVy/+d4pqFtwVrek7pj/NoePyjw17y:7v7SnAeYLpqFEikNj8j07y","tlshash":"6e54972ddb3c1e468ae9d804f3bb81054319f879232694139e8dbf3ddb288ed7396495","first_seen":"2026-08-09T01:32:12.612178Z","last_seen":"2026-08-09T10:00:33.871414Z","times_seen":2,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":33,"connect":18,"send":0,"wait":20,"receive":73,"ssl":25},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-08-09","alert":"Detects hex encoded code that has been base64 encoded","trigger":"pu.biolyroa.com/","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2019-04-29","description":"Detects hex encoded code that has been base64 encoded","reference":"https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/","rule":"SUSP_Base64_Encoded_Hex_Encoded_Code","score":"65"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mxhdjr.com/app/networksolu/media/logo","fqdn":"mxhdjr.com","domain":"mxhdjr.com","tld":"com"},"ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pu.biolyroa.com/","date":"2026-08-09T10:00:07.509Z","timestamp":1786269607509,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mxhdjr.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:BD:B0:D9:CB:F8:4F:8D:5E:D9:9F:24:21:53:47:60:18:E3:8F:05","sha256":"B3:DB:A7:27:FC:BF:16:F1:AC:25:6C:ED:B8:77:DC:3F:6F:30:32:76:36:CF:33:1F:39:69:71:48:8F:10:17:46"}}},"request":{"raw":"GET /app/networksolu/media/logo HTTP/1.1\r\nHost: mxhdjr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Fri, 06 Jun 2025 21:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4342\r\ndate: Sun, 09 Aug 2026 10:00:07 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4342,"size_decoded":4523,"mime_type":"image/png","magic":"PNG image data, 154 x 62, 8-bit/color RGBA, non-interlaced","md5":"8d74d147618554291f8cb17959e22450","sha1":"4602c88a77f1ae4832e5943a9f31e6dc46c4019c","sha256":"38f4cd5c0c12b0655856bb8470b15392154ebad70467d63a577ff730e8f248df","sha512":"5677c216106a72ea816b3c44ff3e62a72d1ecf6661c8c18c3e7b885577ddd582df401dc7e3220d9a5894faf63547c79bfb6dacbd33d510161461ebcaa39cfb69","ssdeep":"96:DScG+WWD284hWhWlN1UQ9AXZ1DDlkA9R2S/hcOd8EBOv:DScEw28aW6AkA9R2S5cOOEBOv","tlshash":"53917dd6a9c04cc6dbeb4d3ad295b8ebc26e0fb90043e51844fad539431bc10c7ae1ad","first_seen":"2023-05-01T23:08:16Z","last_seen":"2026-08-09T14:24:24.367799Z","times_seen":7468,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webmail-oxcs.networksolutionsemail.com/appsuite/favicon.svg?version=3999779421","fqdn":"webmail-oxcs.networksolutionsemail.com","domain":"networksolutionsemail.com","tld":"com"},"ip":{"addr":"198.251.71.220","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pu.biolyroa.com/","date":"2026-08-09T10:00:07.642Z","timestamp":1786269607642,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /appsuite/favicon.svg?version=3999779421 HTTP/1.1\r\nHost: webmail-oxcs.networksolutionsemail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ndate: Sun, 09 Aug 2026 10:00:08 GMT\r\ncontent-type: application/xml\r\nx-amz-request-id: tx000006244005533d5449b-006a784fa8-18709cae6-msc1\r\nx-app-server: rgw14ham1\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload;\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T13:49:05.127389Z","times_seen":17799766,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pu.biolyroa.com/favicon.ico","fqdn":"pu.biolyroa.com","domain":"biolyroa.com","tld":"com"},"ip":{"addr":"77.68.67.156","port":443,"asn":8560,"as":"IONOS SE","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pu.biolyroa.com/","date":"2026-08-09T10:00:06.462Z","timestamp":1786269606462,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: pu.biolyroa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pu.biolyroa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T13:49:05.127389Z","times_seen":17799766,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"pu.biolyroa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mxhdjr.com/app/networksolu/media/main-781bf877.css","fqdn":"mxhdjr.com","domain":"mxhdjr.com","tld":"com"},"ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pu.biolyroa.com/","date":"2026-08-09T10:00:06.813Z","timestamp":1786269606813,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mxhdjr.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:BD:B0:D9:CB:F8:4F:8D:5E:D9:9F:24:21:53:47:60:18:E3:8F:05","sha256":"B3:DB:A7:27:FC:BF:16:F1:AC:25:6C:ED:B8:77:DC:3F:6F:30:32:76:36:CF:33:1F:39:69:71:48:8F:10:17:46"}}},"request":{"raw":"GET /app/networksolu/media/main-781bf877.css HTTP/1.1\r\nHost: mxhdjr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 16 Aug 2026 10:00:07 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 06 Jun 2025 21:57:44 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 50622\r\ndate: Sun, 09 Aug 2026 10:00:07 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":342558,"size_decoded":51010,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (61468)","md5":"0b47d8c2153027bbb01929b8872e077d","sha1":"ad68622abc534babd02c655fdb5d3b744a2f0408","sha256":"781bf8770b0fd1f8b0c4a0d1c930ff58c7a7211780bdcf594b1ade206fec2fe9","sha512":"04c8499b9b285c4d1b5197c1f8c18489e2688a84c4934a375a2dec63f35cd3e973e943997c5c106eaac0d05058e4d9500b7175f0316cd003a0732ebccfe9b6c8","ssdeep":"1536:BlV3imHCI6AHZyaq2k3Sdyqh4B7Q01FDk4sMt7QRXSbWowqb59e5zv68:ZVf07Q01FDk4sMt7QRXQWY59e5zC8","tlshash":"5f74d514a310303f3867c06679d4bd97be16a05fdc6a4bbaf42694a803ce5d72237e76","first_seen":"2024-01-11T05:06:02Z","last_seen":"2026-08-09T10:00:33.881604Z","times_seen":490,"resource_available":false,"data":null}},"time_used":678,"timings":{"blocked":-1,"dns":33,"connect":124,"send":0,"wait":248,"receive":127,"ssl":145},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mxhdjr.com/app/networksolu/media/index.html.js.download","fqdn":"mxhdjr.com","domain":"mxhdjr.com","tld":"com"},"ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pu.biolyroa.com/","date":"2026-08-09T10:00:06.817Z","timestamp":1786269606817,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mxhdjr.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:BD:B0:D9:CB:F8:4F:8D:5E:D9:9F:24:21:53:47:60:18:E3:8F:05","sha256":"B3:DB:A7:27:FC:BF:16:F1:AC:25:6C:ED:B8:77:DC:3F:6F:30:32:76:36:CF:33:1F:39:69:71:48:8F:10:17:46"}}},"request":{"raw":"GET /app/networksolu/media/index.html.js.download HTTP/1.1\r\nHost: mxhdjr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/octet-stream\r\nlast-modified: Fri, 06 Jun 2025 21:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4459\r\ndate: Sun, 09 Aug 2026 10:00:07 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T13:49:05.127389Z","times_seen":17799766,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mxhdjr.com/app/networksolu/media/error-generic.svg","fqdn":"mxhdjr.com","domain":"mxhdjr.com","tld":"com"},"ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pu.biolyroa.com/","date":"2026-08-09T10:00:07.507Z","timestamp":1786269607507,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mxhdjr.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:BD:B0:D9:CB:F8:4F:8D:5E:D9:9F:24:21:53:47:60:18:E3:8F:05","sha256":"B3:DB:A7:27:FC:BF:16:F1:AC:25:6C:ED:B8:77:DC:3F:6F:30:32:76:36:CF:33:1F:39:69:71:48:8F:10:17:46"}}},"request":{"raw":"GET /app/networksolu/media/error-generic.svg HTTP/1.1\r\nHost: mxhdjr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sun, 16 Aug 2026 10:00:07 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 06 Jun 2025 21:57:43 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1688\r\ndate: Sun, 09 Aug 2026 10:00:07 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5081,"size_decoded":2022,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bd20ccc0e2c46e063663be1fb8ece5d7","sha1":"7c64092a73dc42a3eddb5d1393b146b7b1818257","sha256":"0ca8f37a2863dc15192234ec9fe2c54d3a9e97b68a51fa2a38b09c3e52f73722","sha512":"b5f3c788865c6beb1c9a9188ab4ffbc3ed6d0e458a3a0d7788e8a01a12f095a0649f7ff10172b0af827850a1eacd610cace943d5ec85ce103f5de66151792494","ssdeep":"96:4GyFOZ3gdZ9DU9Zjzgcj+k28lNvB94AN3:4TOZ3K9Y9Zjvj7rlNp94A1","tlshash":"c4a1c6e4299c85aef44747d8cf98216e043e70ff28699954799e06f0df012ee2c7f446","first_seen":"2023-05-15T10:40:11Z","last_seen":"2026-08-09T10:00:33.88333Z","times_seen":500,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}