{"report_id":"ae185cba-13b1-4fe5-b217-a176bf7e06fd","version":0,"status":"done","tags":["google"],"date":"2026-08-04T14:27:27Z","url":{"schema":"http","addr":"glelcbd.com/worksapce-voice/audio-wav/index.html","fqdn":"glelcbd.com","domain":"glelcbd.com","tld":"com"},"ip":{"addr":"103.125.253.25","port":0,"asn":38200,"as":"BTS Communications BD ltd","country":"Bangladesh","country_code":"BD"},"final":{"url":{"schema":"https","addr":"glelcbd.com/82b124fb-e268-4ff3-9eab-68f89d9fe0b9#","fqdn":"glelcbd.com","domain":"glelcbd.com","tld":"com"},"title":"Sign in - Google Accounts","dom":{"size":1410,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"83c9453e47cceac11a8111ae93a0214f","sha1":"00f5371cfbbde1268c861838468f55d826d1a61d","sha256":"abf9e30f9a301566e493b12ced42f27540cbe94fffe70b8f0de49a756890d851","sha512":"5b44352e28cd12aa8a17a8157daecc631bb3d04abf28f3aaf2bbfc3272028d05410b41637cc57660a40e3ca7e56e0d4fd4a372211183510e2ef8a34873259f34","ssdeep":"","tlshash":"58210fa324b684251712849674b7b68c29a6700b3e04cd8d31cc81699f44fa7cce39fc","dom_hash":"domhash84382c593afbe02c16f0582e22525593","first_seen":"2026-08-04T14:27:33.321204Z","last_seen":"2026-08-04T14:27:33.321204Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"glelcbd.com/worksapce-voice/audio-wav/index.html","fqdn":"glelcbd.com","domain":"glelcbd.com","tld":"com"},"ip":{"addr":"103.125.253.25","port":0,"asn":38200,"as":"BTS Communications BD ltd","country":"Bangladesh","country_code":"BD"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-08T14:27:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"glelcbd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"glelcbd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]},"summary":[{"fqdn":"glelcbd.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2023-07-20","domain_rank":0,"first_seen":"2019-07-25T06:28:45Z","last_seen":"2026-08-03T15:59:21.715756Z","alert_count":6,"request_count":2,"received_data":2555,"sent_data":1050,"comment":"","tags":null,"fingerprints":[{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.251.154.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-08-02T22:52:22.854993Z","alert_count":0,"request_count":1,"received_data":6137,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-08-03T08:33:08.849841Z","alert_count":0,"request_count":3,"received_data":271904,"sent_data":1465,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ipapi.co","ip":{"addr":"172.67.69.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-07-30T01:51:08.032267Z","alert_count":0,"request_count":1,"received_data":2497,"sent_data":458,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-02T22:20:16.100749Z","alert_count":0,"request_count":1,"received_data":43949,"sent_data":570,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-02T22:23:34.841384Z","alert_count":0,"request_count":1,"received_data":17419,"sent_data":529,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"spy.mwork801.com","ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"domain_registered":"2026-02-25","domain_rank":0,"first_seen":"2026-08-04T05:36:05.278523Z","last_seen":"2026-08-04T05:36:05.278523Z","alert_count":11,"request_count":11,"received_data":880402,"sent_data":6318,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Bootstrap:5.3.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-08-02T23:01:36.865069Z","alert_count":0,"request_count":4,"received_data":372543,"sent_data":2060,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/start.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"10c0a4ac06682a01ce1a34eb596cfa04","sha1":"3d31bc698a092bcbfff472c062e10dde6ba75aae","sha256":"4edda58e5b793fe38736a3869f9d30992728d12c0c4b3a048d74d99a1659c8e1","sha512":"96ac35ee10d80aa41125db6f9364d1bab96894bfe1f616c7fb79eafebd8f0e74dc7f6aef8d6651348ba27a46edffdc228a03df9a2b2f1bf845840a7f4cc3baf7","ssdeep":"","tlshash":"e761a8a735b71a3642eb20ae2b3b61087676000b3905ec5af95c8e40af50f79a5736cd","size":3280,"data":"","first_seen":"2026-07-27T18:34:00.274729Z","last_seen":"2026-08-05T05:31:09.29421Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e477967e482f32e65d4ea9b2fd8e106","sha1":"ddc6e9ead6d16ae9237399ce41e8c1620cc59c36","sha256":"0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c","sha512":"ecf8bfa2d7656db091f8b9d6f85ecfc057120c93ae5090773b1b441db838bd232fcef26375ee0fa35bf8051f4675cf5a5cd50d155518f922b9d70593f161741a","ssdeep":"1536:WmwIiEEO+TBR2t4J9RirWDKsVA5y7fy3YJtC/r/45wZbfbXZTb0WU078:HwORx3YCD45wZbDZTb0g8","tlshash":"ce73c5593244b4730ade85b68037430bf2265998b24b812cb57cadde2a7dcc67277f78","size":80721,"data":"","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-05T18:46:05.145386Z","times_seen":30468,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"f5ec46fa826947d0cd916101b86b2cc1","sha1":"27a2ec06268b8e46034b663eae514da9eb365952","sha256":"f518eea061c5a79dff39715dfb0ae6de427f85ac3fd855e827aff83b28947fce","sha512":"d003d9a169dd34138d1ac47d7d2f42b7649c4e1892e3a0aade9d1ef88f507586529e4621ede17f73b07ba5f8148d268d0889cc2329a6b29af0d5763bce953182","ssdeep":"","tlshash":"65c09b751c1040336c6504fc6515dab47d67373222716510e55cd174441cd6f54429e1","size":133,"data":"","first_seen":"2026-06-16T06:19:14.731548Z","last_seen":"2026-08-05T05:31:09.305029Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"060abc29a82860b80bc14b350dde7478","sha1":"406f7a4a8e7700c4cc2aa348692157c85d6c9f9a","sha256":"f5c6863f2f6cc390e86aa6a5dfd60298112a779a398895894aec8e79dd1f7f9f","sha512":"07fe699732ab738f5f1552410e9e981390cbbd97b6314b5ecb64ae9f3b5d75d85427df531ef29a9a01b235447ccafa126e0384fb7a2b2779ef2c8fc6bb5644bc","ssdeep":"","tlshash":"1dd02bdb8002916239f31086a3177344707300667840d083780c9a101b69f8fca5face","size":287,"data":"","first_seen":"2026-06-16T06:19:14.73258Z","last_seen":"2026-08-05T05:31:09.305931Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/intl-tel-input@18/build/js/intlTelInput.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e669525b552f1c01f67fc22d725b14ae","sha1":"745a50c5ec7e8af53349aee906755a194a7fc9b2","sha256":"f1a2d340dd4328bcf299da8143d4bc88b76ff400c1b2737ded165d24949b8990","sha512":"8ec68ea281bb960a158643f14fb20beaf24d3123cc6f5810aafa0e6be63046aa35a78d74c3b585e911706db2c12e315514684bd31eee2ec0611d0d8aa06acfac","ssdeep":"768:D3rXNC+I4SAGFdGc6HLZSV0Pu81yv4ppIsiCJmGR:jk3GcyyotfpIvCV","tlshash":"bcd2f8edb3552236a9ad9071647f12076ebf30015a84989d787ecdc81fdcec960b6b38","size":30824,"data":"","first_seen":"2024-12-07T20:42:42.6026Z","last_seen":"2026-08-05T09:58:31.585877Z","times_seen":143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","size":89664,"data":"","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-05T18:48:00.739818Z","times_seen":34116,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/main.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"64df8a5718abe34e13283c36b3867527","sha1":"e92d65aad22854fe6cbf91328437d31f92abcdaf","sha256":"1d63104c08e024fe30f1d5b058859b804da622e6ccb75e99f315a284283f4d2b","sha512":"e41d86b07820667756935f42540ae2c3077478ebff89e382c668e7ecd099875a4b5789a329d651d6644ccf846f235b48e232bc836e8c52acdc3caf5b8bcb67e0","ssdeep":"768:8VeHFA6NQSNCLOFaLU8k4pW+VhQ5dhQ5hxhPSlDDLPZhyhKTB2GwKX833m:8MF1NQSNMUcQpQdhKlDDLP6hKTB2GwK7","tlshash":"8933d85ab2ec13b9e53704bd6e7f2c401ad8389faac9c40cf62d19d18f5ca95f82161d","size":53145,"data":"","first_seen":"2026-06-16T06:19:14.697731Z","last_seen":"2026-08-05T05:31:09.297104Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"glelcbd.com/82b124fb-e268-4ff3-9eab-68f89d9fe0b9#","fqdn":"glelcbd.com","domain":"glelcbd.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a5250c933201b3bbf3d825d4709b7450","sha1":"d8dc11344dbe96d5f70d6022084383a67a29c423","sha256":"cef3ed848b9f9df0516042f4b4c406cf854c7b5080829fa3559239e7ab11e5be","sha512":"102835de3d0b0de0fd65dac2f91d4230baf42976b10f1a55f4d87d18ac201011edaf2ba39743e7f0c422b6f7b1f0c472a18955241dcf2d74fb099c55a8a583cc","ssdeep":"","tlshash":"55f0222634631034196b558b223b9bd4b4f630133800dc8c318dd4d88f05f1bd0a7ead","size":502,"data":"","first_seen":"2026-07-21T00:19:19.744591Z","last_seen":"2026-08-05T05:31:09.306798Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"glelcbd.com/favicon.ico","fqdn":"glelcbd.com","domain":"glelcbd.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://glelcbd.com/worksapce-voice/audio-wav/index.html","date":"2026-08-04T14:27:01.344Z","timestamp":1785853621344,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"glelcbd.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Jul 2026 00:31:11 GMT","end":"Wed, 30 Sep 2026 00:31:10 GMT"},"fingerprint":{"sha1":"EA:BE:CE:B7:C2:B8:D2:B3:67:2E:3F:3B:EB:36:36:BD:36:42:56:28","sha256":"8C:47:02:BC:E9:DE:80:A5:62:DF:A4:84:13:4C:CA:F6:2D:30:32:1F:13:21:E0:E6:1D:97:68:9C:8D:91:B6:69"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: glelcbd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://glelcbd.com/worksapce-voice/audio-wav/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-05T20:03:22.310306Z","times_seen":17730251,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"glelcbd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"glelcbd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"www.google.com/favicon.ico","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.154.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://glelcbd.com/worksapce-voice/audio-wav/index.html","date":"2026-08-04T14:27:01.524Z","timestamp":1785853621524,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:37:25 GMT","end":"Mon, 21 Sep 2026 08:37:24 GMT"},"fingerprint":{"sha1":"D9:DA:81:30:78:3E:9C:6B:5F:9D:18:52:0E:BE:6D:52:2F:FB:33:E0","sha256":"EA:E2:2D:87:EC:9C:D6:51:9D:59:E4:13:35:3B:97:14:E3:DA:58:2D:1C:69:19:41:54:94:25:C3:94:17:F3:0C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 1494\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 04 Aug 2026 10:14:05 GMT\r\nexpires: Wed, 12 Aug 2026 10:14:05 GMT\r\ncache-control: public, max-age=691200\r\nlast-modified: Tue, 22 Oct 2019 18:30:00 GMT\r\ncontent-type: image/x-icon\r\nvary: Accept-Encoding\r\nage: 15176\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":5430,"size_decoded":2201,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"f3418a443e7d841097c714d69ec4bcb8","sha1":"49263695f6b0cdd72f45cf1b775e660fdc36c606","sha256":"6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770","sha512":"82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563","ssdeep":"48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B","tlshash":"65b1b8b7e6c63030c85805bc49373a6d1e1b6ee31a9cf064fecc326a1a320d175256be","first_seen":"2023-04-05T04:39:39Z","last_seen":"2026-08-05T18:50:11.08078Z","times_seen":85462,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":5,"connect":23,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.019Z","timestamp":1785853623019,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /ajax/libs/jquery/3.6.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31100\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 29 Jul 2026 13:10:33 GMT\r\nexpires: Thu, 29 Jul 2027 13:10:33 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 522990\r\nlast-modified: Thu, 08 Sep 2022 18:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":89664,"size_decoded":32064,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-05T18:48:00.739818Z","times_seen":34116,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/css/load.css","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.022Z","timestamp":1785853623022,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/css/load.css HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"5beec-19f8ed18c9c\"\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 376556\r\nDate: Tue, 04 Aug 2026 14:27:03 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":376556,"size_decoded":376908,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (36751)","md5":"a48df3e18c59479b08ea9c2c5c411672","sha1":"f9723d48f39cb331f55a913a6aa125ed7304028c","sha256":"0dde3f4181697f7d70eead2e35e1dc3e2ac72283c646b7e82f1ebec68143d3c9","sha512":"0ceb9f41a85b4298b4aa56182a4c8935aa885053f56f4c3f93db1c61448d3bb0351a2b452df39668faefa7cbcfde0d8e1abb8a0bebe33f0b62cade4be324752f","ssdeep":"6144:x6CkjT5q3j6/8+Qq3j6/8+dq3j6/8+tq3j6/8+Iq3j6/8+Aq3j6/8+HQISNt1/bP:x6CkjTtKqSMT","tlshash":"43841ddf9231b07ff932a4b5d9c0ae49f2c989c0f65b4576bc70ba1741ab6a61391330","first_seen":"2026-02-13T13:38:22.7519Z","last_seen":"2026-08-05T05:31:09.301615Z","times_seen":10,"resource_available":false,"data":null}},"time_used":1049,"timings":{"blocked":-1,"dns":0,"connect":130,"send":0,"wait":262,"receive":521,"ssl":136},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/favico.png","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.031Z","timestamp":1785853623031,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/favico.png HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"ec00-19f8ed18c9c\"\r\nContent-Type: image/png\r\nContent-Length: 60416\r\nDate: Tue, 04 Aug 2026 14:27:04 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":60416,"size_decoded":60752,"mime_type":"image/png","magic":"PNG image data, 2084 x 2084, 8-bit/color RGBA, non-interlaced","md5":"2283a397277610f3965d1a3a3d8d8417","sha1":"2b8bcc5004eddb9f5932c99979849c15e8192ffc","sha256":"e4722fe7a85e003c53066827ecccf5139439c6de9cf6cee7e359dd1ce5bd9a51","sha512":"83d512cd82e330d37647716fa5fcb24189bf1522c6ddfbcad8b6357a49ab005c4c8547d98d992ff191adec898cdc23ba994769a44227e410472d243a8f02eb33","ssdeep":"1536:ftNzNaKiSC5cI4moYvvB+2uWtmJBDjAzZM3+HDL:fthMKLf++W4PIzZMujL","tlshash":"c34349bb20066d94c4a969ba588896dcfb365db88a97274f407167beccfd7d42cc0c43","first_seen":"2024-04-10T06:17:36Z","last_seen":"2026-08-05T05:31:09.295326Z","times_seen":11,"resource_available":false,"data":null}},"time_used":1301,"timings":{"blocked":1039,"dns":0,"connect":0,"send":0,"wait":136,"receive":126,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/intl-tel-input@18/build/js/intlTelInput.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.116Z","timestamp":1785853623116,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/intl-tel-input@18/build/js/intlTelInput.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 10572\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 18.5.3\r\nx-jsd-version-type: version\r\netag: W/\"7868-dFpQxex+ivUzSa7pBnVaGUp/ybI\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 2154\r\ndate: Tue, 04 Aug 2026 14:27:03 GMT\r\nx-served-by: cache-fra-eddf8230046-FRA, cache-bma-essb1270071-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30824,"size_decoded":11328,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27383)","md5":"e669525b552f1c01f67fc22d725b14ae","sha1":"745a50c5ec7e8af53349aee906755a194a7fc9b2","sha256":"f1a2d340dd4328bcf299da8143d4bc88b76ff400c1b2737ded165d24949b8990","sha512":"8ec68ea281bb960a158643f14fb20beaf24d3123cc6f5810aafa0e6be63046aa35a78d74c3b585e911706db2c12e315514684bd31eee2ec0611d0d8aa06acfac","ssdeep":"768:D3rXNC+I4SAGFdGc6HLZSV0Pu81yv4ppIsiCJmGR:jk3GcyyotfpIvCV","tlshash":"bcd2f8edb3552236a9ad9071647f12076ebf30015a84989d787ecdc81fdcec960b6b38","first_seen":"2024-12-07T20:42:42.6026Z","last_seen":"2026-08-05T09:58:31.585877Z","times_seen":143,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"172.67.69.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:04.125Z","timestamp":1785853624125,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Jun 2026 05:11:37 GMT","end":"Sun, 13 Sep 2026 06:11:34 GMT"},"fingerprint":{"sha1":"CE:63:0D:F2:C0:D2:04:93:CA:AE:0D:AA:ED:9F:31:01:7A:BC:69:40","sha256":"0D:2E:E4:8D:BD:B6:76:95:B5:BD:B8:C5:CE:61:98:B9:6E:81:B5:4B:16:5C:C0:0C:C9:FB:54:0B:B4:A6:7C:65"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://spy.mwork801.com/\r\nOrigin: https://spy.mwork801.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 04 Aug 2026 14:27:07 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, HEAD, OPTIONS, POST, GET\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://spy.mwork801.com\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UZ%2Bqk3Y1mTkSjjFjsMIazxX3Inzj7dd1Z%2Fw%2BXYfqkbMxLm2C1RLPWT7E7EyChFjKUvNlB%2BSYYcLppxg28fblKDr07rTK3EW7rYYAk08uziRqDSFij7fWqlZM\"}]}\r\ncontent-encoding: br\r\ncf-ray: a25e3db29b7556c3-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2105,"mime_type":"application/json","magic":"JSON text data","md5":"c072daa1c2cda30d0f3f81ca812ae319","sha1":"d5445a8099ed4730982271c1ed6f80fa78de8c14","sha256":"33c5189253a521d59112bc6a96710c6dee86b2d05e85e945f5bd56ac736c425c","sha512":"84df51623e52eb7458514c9b46c5fac80f3293a9123643f4f411ee7fbaec100ce117dd72327d9a9c16254ab67b90c36d536b902c003b5a10c304974f44478743","ssdeep":"","tlshash":"f6012f68e4780e7b9cb813587078690b103422176e523a8e7bc0a74d0f8d8bf30b035e","first_seen":"2026-08-03T13:31:59.23668Z","last_seen":"2026-08-05T18:26:30.017551Z","times_seen":65,"resource_available":false,"data":null}},"time_used":3396,"timings":{"blocked":0,"dns":3,"connect":2,"send":0,"wait":218,"receive":0,"ssl":3173},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:04.152Z","timestamp":1785853624152,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:25 GMT","end":"Mon, 21 Sep 2026 08:39:24 GMT"},"fingerprint":{"sha1":"4E:F2:73:C6:27:16:58:35:FE:55:D5:30:6B:E8:6D:2B:DA:B0:E8:7B","sha256":"82:EF:6A:61:96:A5:23:D6:2C:2C:9D:77:67:04:D8:7B:3B:6A:50:DA:3C:6C:6A:5F:4E:2D:55:F3:FC:DA:0B:EE"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://spy.mwork801.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 30 Jul 2026 10:17:38 GMT\r\nexpires: Fri, 30 Jul 2027 10:17:38 GMT\r\ncache-control: public, max-age=31536000\r\nage: 446966\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":43136,"size_decoded":43949,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-05T20:03:06.429164Z","times_seen":254851,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":0,"dns":3,"connect":32,"send":0,"wait":20,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"glelcbd.com/worksapce-voice/audio-wav/index.html","fqdn":"glelcbd.com","domain":"glelcbd.com","tld":"com"},"ip":{"addr":"103.125.253.25","port":443,"asn":38200,"as":"BTS Communications BD ltd","country":"Bangladesh","country_code":"BD"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-04T14:26:59.591Z","timestamp":1785853619591,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"glelcbd.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Jul 2026 00:31:11 GMT","end":"Wed, 30 Sep 2026 00:31:10 GMT"},"fingerprint":{"sha1":"EA:BE:CE:B7:C2:B8:D2:B3:67:2E:3F:3B:EB:36:36:BD:36:42:56:28","sha256":"8C:47:02:BC:E9:DE:80:A5:62:DF:A4:84:13:4C:CA:F6:2D:30:32:1F:13:21:E0:E6:1D:97:68:9C:8D:91:B6:69"}}},"request":{"raw":"GET /worksapce-voice/audio-wav/index.html HTTP/1.1\r\nHost: glelcbd.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 04 Aug 2026 14:27:00 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 31 Jul 2026 17:27:35 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 2312\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2312,"size_decoded":2555,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a625b9f87a6f875d87ef0f9b4c9de302","sha1":"7abe5995603e32e5982a08d807f6825699e04836","sha256":"8ce1a1fafe779099e02a349fdad52a9353148e06e8cf570d27b8605f80838e62","sha512":"742d1f78bcde83741d3e24de23310d163048bab883dcedd4f1fc0108e0c3d3d979e45b10f4d78559c4e17b43040023e1aca53945dd48349d134e72ea1847e2a0","ssdeep":"","tlshash":"c441519668808c29167181a26ba3b24ce97371473b80ce8d35cc912b4f75b59cce3adc","first_seen":"2026-08-04T05:36:12.307616Z","last_seen":"2026-08-05T05:31:09.299835Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1222,"timings":{"blocked":-1,"dns":428,"connect":196,"send":0,"wait":203,"receive":0,"ssl":395},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"glelcbd.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"glelcbd.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://glelcbd.com/worksapce-voice/audio-wav/index.html","date":"2026-08-04T14:27:01.372Z","timestamp":1785853621372,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /ajax/libs/jquery/3.6.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31100\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 29 Jul 2026 13:10:33 GMT\r\nexpires: Thu, 29 Jul 2027 13:10:33 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 522988\r\nlast-modified: Thu, 08 Sep 2022 18:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":89664,"size_decoded":32064,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-05T18:48:00.739818Z","times_seen":34116,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://glelcbd.com/worksapce-voice/audio-wav/index.html","date":"2026-08-04T14:27:02.823Z","timestamp":1785853622823,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1 HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"65f1-19f8ed18c9c\"\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 26097\r\nDate: Tue, 04 Aug 2026 14:27:02 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Bootstrap:5.3.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":26097,"size_decoded":26448,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (510)","md5":"0fc29ce20de165a5a3506b7abdce12de","sha1":"91703d8f7775f6b961d27de270ebef7acf259f77","sha256":"6194a33994e03e92876b6ea6f00bbc60c389e712e4b9122bce28d0d982dfd55a","sha512":"c3de91fef3f5667f84caa80291c744291689289db316fc79208b68335d76233b0e32c05c30a84f334b889ddac4a089c8f6392a4237191e09bdab74bea4f71efb","ssdeep":"384:l2k11lx1HxMncHM97Wj4qmHMNOUmHMVxWnMd27S:l2k11NxMcHMcs/HM8HMjWnM8S","tlshash":"4ec23d2061f0542351928090ba746e2f3e53e25bde0b4a5877fc0be16f8bde2dd6766c","first_seen":"2026-06-16T06:19:14.705396Z","last_seen":"2026-08-05T05:31:09.290569Z","times_seen":6,"resource_available":false,"data":null}},"time_used":262,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":132,"receive":130,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/css/main.css","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.024Z","timestamp":1785853623024,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/css/main.css HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"1558-19f8ed18c9c\"\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 5464\r\nDate: Tue, 04 Aug 2026 14:27:03 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":5464,"size_decoded":5813,"mime_type":"text/css; charset=utf-8","magic":"assembler source, ASCII text","md5":"0bace82aa6e0e34904f1a9f2c0172f53","sha1":"9571a46b4aefcea9a8271e4e10b86d9c9ac9e24b","sha256":"27faa4c5bd4ea518b7826ecfec4476e231cbe9c7238bb847bf08918561e62b44","sha512":"a756ff45e84c7dbb590f3189e9dbe31558428ee7da4ec2d3e4d53ff70f6277842647ce68ed585ceb9d63aefb52d47fa1769de1e5047e7455d04a726569ec901c","ssdeep":"48:QO0dHZTkiW/gNjv+4J1vfJWYJj/QTQ5DJVK0C+F5TYqFcqjF0D/BkTDOuLW3RvvS:EHZkiUp4rrZos1rF5fFFFFQ3+cY2XY","tlshash":"d1b1e043a6b34f51381b516433ee92ab7b7961034a0ede683f8c32a08f413fa75527c8","first_seen":"2026-05-05T12:43:05.982908Z","last_seen":"2026-08-05T05:31:09.288684Z","times_seen":8,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":130,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.025Z","timestamp":1785853623025,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap@5.3.3/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 5.3.3\r\nx-jsd-version-type: version\r\netag: W/\"38d63-xawd7pYctZoEUlbsID9p4xeHL3w\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 04 Aug 2026 14:27:03 GMT\r\nage: 2945127\r\nx-served-by: cache-fra-eddf8230218-FRA, cache-bma-essb1270027-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 33206\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232803,"size_decoded":33987,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65342)","md5":"a549af2a81cd9900ee897d8bc9c4b5e9","sha1":"c5ac1dee961cb59a045256ec203f69e317872f7c","sha256":"3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8","sha512":"8e74ae0384acd8f9248a448e2ed62cf0195821e7882b587df6dcb861fbd13c0973af7efbbebdc25c36fbb1bede1040588c3b5c623f808c11f714bbf9b9226e5e","ssdeep":"1536:O9YnIWbn98fdRfvO5wlP77k9P3EV98IsYRElV6V6pz600I41r:RnIw98fbV986I6V6pz600I41r","tlshash":"dc3482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-05T18:57:40.881115Z","times_seen":26040,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":9,"send":0,"wait":10,"receive":4,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Roboto:wght@300;400;500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.027Z","timestamp":1785853623027,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=Roboto:wght@300;400;500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 04 Aug 2026 14:27:03 GMT\r\ndate: Tue, 04 Aug 2026 14:27:03 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16755,"size_decoded":2347,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"110e0aca6ca30b48bfdcc77c30eeb6bf","sha1":"21ee214ed15b2a4e80a4dc7131fa3fff5c141e9f","sha256":"0e02306b564f44631f56bcb6470cc16776743354779ebe283caf45ef7b447073","sha512":"38b6b3ecce638611cdf1aeb23ac77dda220a4d3a4c4a76119bc0c7a10427c4b984398ea785d0d003c9174b33da66388c786fed2ecff7421b26a4f799f8dff71f","ssdeep":"384:p9f59g9P9r9yU9/qY4+949Y9p9fM919W969yh9/qY4X9N9t9i9fD9O9d9B9ya9/E:pDS99YURRuWDyjooYhREHPM5svvYaR78","tlshash":"307210a1041744009b834ce223cebf35fe1f52117142d0b5abfd9b6b9ddbca6526939d","first_seen":"2026-02-20T02:54:07.842809Z","last_seen":"2026-08-05T05:31:09.292424Z","times_seen":1373,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":2,"connect":17,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/main.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.118Z","timestamp":1785853623118,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/js/main.js HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"cf9b-19f8ed18c9c\"\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 53147\r\nDate: Tue, 04 Aug 2026 14:27:03 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":53147,"size_decoded":53504,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (29007)","md5":"64df8a5718abe34e13283c36b3867527","sha1":"e92d65aad22854fe6cbf91328437d31f92abcdaf","sha256":"1d63104c08e024fe30f1d5b058859b804da622e6ccb75e99f315a284283f4d2b","sha512":"e41d86b07820667756935f42540ae2c3077478ebff89e382c668e7ecd099875a4b5789a329d651d6644ccf846f235b48e232bc836e8c52acdc3caf5b8bcb67e0","ssdeep":"768:8VeHFA6NQSNCLOFaLU8k4pW+VhQ5dhQ5hxhPSlDDLPZhyhKTB2GwKX833m:8MF1NQSNMUcQpQdhKlDDLP6hKTB2GwK7","tlshash":"8933d85ab2ec13b9e53704bd6e7f2c401ad8389faac9c40cf62d19d18f5ca95f82161d","first_seen":"2026-06-16T06:19:14.697731Z","last_seen":"2026-08-05T05:31:09.297104Z","times_seen":7,"resource_available":true,"data":null}},"time_used":561,"timings":{"blocked":168,"dns":0,"connect":0,"send":0,"wait":262,"receive":131,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/start.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://glelcbd.com/worksapce-voice/audio-wav/index.html","date":"2026-08-04T14:27:01.417Z","timestamp":1785853621417,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/js/start.js HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"cd0-19f8ed18c9c\"\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 3280\r\nDate: Tue, 04 Aug 2026 14:27:01 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":3280,"size_decoded":3635,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"10c0a4ac06682a01ce1a34eb596cfa04","sha1":"3d31bc698a092bcbfff472c062e10dde6ba75aae","sha256":"4edda58e5b793fe38736a3869f9d30992728d12c0c4b3a048d74d99a1659c8e1","sha512":"96ac35ee10d80aa41125db6f9364d1bab96894bfe1f616c7fb79eafebd8f0e74dc7f6aef8d6651348ba27a46edffdc228a03df9a2b2f1bf845840a7f4cc3baf7","ssdeep":"","tlshash":"e761a8a735b71a3642eb20ae2b3b61087676000b3905ec5af95c8e40af50f79a5736cd","first_seen":"2026-07-27T18:34:00.274729Z","last_seen":"2026-08-05T05:31:09.29421Z","times_seen":4,"resource_available":true,"data":null}},"time_used":546,"timings":{"blocked":-1,"dns":143,"connect":134,"send":0,"wait":132,"receive":0,"ssl":137},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/st","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://glelcbd.com/worksapce-voice/audio-wav/index.html","date":"2026-08-04T14:27:01.992Z","timestamp":1785853621992,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"OPTIONS /st HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://glelcbd.com/\r\nOrigin: https://glelcbd.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 204 No Content\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary: Access-Control-Request-Headers\r\nAccess-Control-Allow-Headers: content-type\r\nContent-Length: 0\r\nDate: Tue, 04 Aug 2026 14:27:02 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":329,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-05T20:03:22.310306Z","times_seen":17730251,"resource_available":true,"data":null}},"time_used":395,"timings":{"blocked":0,"dns":0,"connect":130,"send":0,"wait":130,"receive":0,"ssl":135},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/intl-tel-input@18/build/css/intlTelInput.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.028Z","timestamp":1785853623028,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/intl-tel-input@18/build/css/intlTelInput.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 18.5.3\r\nx-jsd-version-type: version\r\netag: W/\"620d-oNGsQ2ble3/C+/PqXqwezWw4bSc\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 04 Aug 2026 14:27:03 GMT\r\nage: 13048\r\nx-served-by: cache-fra-eddf8230226-FRA, cache-bma-essb1270027-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 2935\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25101,"size_decoded":3697,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"14980f4e4ef578a6e70ec46c6a7c7d38","sha1":"a0d1ac4366e57b7fc2fbf3ea5eac1ecd6c386d27","sha256":"4be0304130ec3de2a5541df54e9e9f98c5f0abada1640b9ba4f46896cb575929","sha512":"e2932e00080fd310685628864f34adf5105ede87fe0559f34fd5ae1f66b86e61010b82794a51b63ff9c2484053c6d562ee940a541ceac26fbe8c34c7c9712f7c","ssdeep":"384:ZvImFjFg1M40/imOgs2J9ZE+xfmYqFD1+vSE8k2eOYcyMR:ZQmFjFg1M40FCFZ","tlshash":"c8b273674bb27914f92be1e1386006b2373b5c03f81e5b3d62e63dbd66810e0a4f3695","first_seen":"2024-08-19T19:01:39.489635Z","last_seen":"2026-08-05T09:58:31.610815Z","times_seen":69,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":9,"send":0,"wait":19,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/caution.png","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.032Z","timestamp":1785853623032,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/caution.png HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"26a6-19f8ed18c9c\"\r\nContent-Type: image/png\r\nContent-Length: 9894\r\nDate: Tue, 04 Aug 2026 14:27:04 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":9894,"size_decoded":10229,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"d5238c64724997f80f76a5a2ebbe7022","sha1":"763e31aa26572f09b10308600d0cd9875b797f97","sha256":"85428b402d6b33ab45ad8ff10ff6a966f88e49701c4ae3bd86e9784266b3cd3c","sha512":"6c33a2468582e3c5be49a81a5efb66ccfdaad1e1e09bb50f14eca4520728ec5a38eaac039b5882b061ef7907cf584fe198e90ef6ee04e7b10e1c06b92284948d","ssdeep":"192:nSDkxl4rzaTx874qlfU/+EC3m/AChGZ52AKxchb3K9YW6jlwRl3S:SDK63GcVl8/FC32ZCycVsZ4lwn3S","tlshash":"56129e5df6bde8aa449007de43b309f7d2485970c184fdfc58099de2ccaa64f209aad1","first_seen":"2024-04-10T06:17:36Z","last_seen":"2026-08-05T05:31:09.296215Z","times_seen":11,"resource_available":false,"data":null}},"time_used":1175,"timings":{"blocked":1039,"dns":0,"connect":130,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/account-recovery-sms-pin.gif","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.119Z","timestamp":1785853623119,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/account-recovery-sms-pin.gif HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"44cb6-19f8ed18c9c\"\r\nContent-Type: image/gif\r\nContent-Length: 281782\r\nDate: Tue, 04 Aug 2026 14:27:04 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":281782,"size_decoded":282120,"mime_type":"image/gif","magic":"GIF image data, version 89a, 209 x 170","md5":"f8ecb5d6d71cccada1198edca1bae221","sha1":"57597a278c67f185efed4cd3939e7f5375be3fc0","sha256":"428d97e19e91bd23dfcf73a96d0dd189c29a18a034373ecbfb2678d1524623f0","sha512":"8d09c2fe4a16c7344ae490efa12846f2c174f6e1a3e1b72c5950153b18346c52649cff9491f7709d6a4d4742f7d481074fd4a6db728b80ed4296c230e0cc8522","ssdeep":"6144:5hEQpYQof8AvKfwK4LGun0UzQvACWkkH1MEj4u:5hZoEPfwK9qNQfWkkVMnu","tlshash":"b4540269931f423c782b0dea5079afec32ced9f6535011634a7570f6aab42bc241c6b7","first_seen":"2024-09-19T10:14:43Z","last_seen":"2026-08-05T05:31:09.302495Z","times_seen":517,"resource_available":false,"data":null}},"time_used":1871,"timings":{"blocked":950,"dns":0,"connect":130,"send":0,"wait":262,"receive":392,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/signin_tapyes.gif","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.120Z","timestamp":1785853623120,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/signin_tapyes.gif HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"e9a5-19f8ed18c9c\"\r\nContent-Type: image/gif\r\nContent-Length: 59813\r\nDate: Tue, 04 Aug 2026 14:27:04 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":59813,"size_decoded":60149,"mime_type":"image/gif","magic":"GIF image data, version 89a, 511 x 451","md5":"749f60c166e318ba199cfaca226bc400","sha1":"1b4a13249246377ca3538092ad33add559becee2","sha256":"d95799234a097ba6fe72aec03dfeade73a35afeb458351f153487055c6e46d39","sha512":"3e8d66bbaf1e3ab77799281d3737731784482dad07c27ab457e0def3af09f139cc63178b79acc4f6ca0d4f0c85ca4ab8d4d4cf4ca0e93ae7d8cad1d5f9918102","ssdeep":"768:paL4wke8SCL6PmJAjANRaQ5VAYDEdLJ1QClZGJ7tyC7eWB/ji8x18cuxBOGUbqho:Ah8BL6fWXg91QCG5sC7c8P8cubVUeBAZ","tlshash":"57436a3fd32943a6d6061cb10f4d8e845afbed7844484f97887e516dad0d3ed2c668e2","first_seen":"2024-02-08T01:37:01Z","last_seen":"2026-08-05T05:31:09.303303Z","times_seen":526,"resource_available":false,"data":null}},"time_used":1086,"timings":{"blocked":950,"dns":0,"connect":0,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/arrowdown.png","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.121Z","timestamp":1785853623121,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/arrowdown.png HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Thu, 23 Jul 2026 11:52:05 GMT\r\nETag: W/\"b7-19f8ed18c9c\"\r\nContent-Type: image/png\r\nContent-Length: 183\r\nDate: Tue, 04 Aug 2026 14:27:04 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":183,"size_decoded":515,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"1cdc1f147e49959815a2229280433923","sha1":"5141ff4bea5b5e557482ccb6c408840a1997368c","sha256":"bec61d00c4240e81fbee04980ae0ae8befdd9269b97cb9424b670ed5ff56d6c0","sha512":"c5db6b14b5fd5583b87d20a64ec122d9b6f699229e9dbde88fc05eba4c0056ff02cddf62fa0e4b10979b4ffeff83ca3acd43325d81c9a652ded94206fae7e12d","ssdeep":"","tlshash":"a2c0c0eb7e817c7fc0984752c15b8050a453225c052370d007710854311c5f01068733","first_seen":"2026-05-05T12:43:05.995386Z","last_seen":"2026-08-05T05:31:09.298041Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1347,"timings":{"blocked":950,"dns":0,"connect":130,"send":0,"wait":131,"receive":0,"ssl":135},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://glelcbd.com/worksapce-voice/audio-wav/index.html","date":"2026-08-04T14:27:01.202Z","timestamp":1785853621202,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /ajax/libs/jquery/3.6.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://glelcbd.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31100\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 29 Jul 2026 13:10:33 GMT\r\nexpires: Thu, 29 Jul 2027 13:10:33 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 522988\r\nlast-modified: Thu, 08 Sep 2022 18:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":89664,"size_decoded":32084,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-05T18:48:00.739818Z","times_seen":34116,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":16,"receive":15,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=607144024392330977566287208719\u0026cid=null\u0026warning=1#","date":"2026-08-04T14:27:03.020Z","timestamp":1785853623020,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 5.3.3\r\nx-jsd-version-type: version\r\netag: W/\"13b51-3cbp6tbRaukjc5nOQejBYgzFnDY\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 04 Aug 2026 14:27:03 GMT\r\nage: 2945127\r\nx-served-by: cache-fra-eddf8230066-FRA, cache-bma-essb1270027-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 24464\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80721,"size_decoded":25259,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"2e477967e482f32e65d4ea9b2fd8e106","sha1":"ddc6e9ead6d16ae9237399ce41e8c1620cc59c36","sha256":"0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c","sha512":"ecf8bfa2d7656db091f8b9d6f85ecfc057120c93ae5090773b1b441db838bd232fcef26375ee0fa35bf8051f4675cf5a5cd50d155518f922b9d70593f161741a","ssdeep":"1536:WmwIiEEO+TBR2t4J9RirWDKsVA5y7fy3YJtC/r/45wZbfbXZTb0WU078:HwORx3YCD45wZbDZTb0g8","tlshash":"ce73c5593244b4730ade85b68037430bf2265998b24b812cb57cadde2a7dcc67277f78","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-05T18:46:05.145386Z","times_seen":30468,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":2,"connect":8,"send":0,"wait":9,"receive":9,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}