{"report_id":"c1a48291-5a4a-4425-91fa-fe0af58b7655","version":0,"status":"done","tags":[],"date":"2026-08-16T02:38:59Z","url":{"schema":"http","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"172.67.220.100","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/#/","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"title":"ki1wrevfps6s.cityabovetheclouwst.us.cc/","dom":{"size":123072,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (40058)","md5":"dcd6d425c460b2f34f60cd5f5f0fa929","sha1":"3fa70dd42bf0176234c326ceea9dee6e2a71e013","sha256":"4f950bd4f07f268a1c4a86b8ef4af81e39e7a9b5ddd9a42ad6bd5ecae7ad63d1","sha512":"25a081a6e53e7e0908e1f150a4486d9c53c977768857640f6dadf88f3805c3b6d8b46232672032a99677fa17066edf173e925100fad0a3e0bae9dc12dc015d31","ssdeep":"3072:8sp0NVr7fnaM/51fuPlIHGvXNWPf1f4yH9sUnbauJ9BxEuMa8Qc1tblK1mklU5QC:grr7fnFU","tlshash":"32c34392b688245dea3bcd86d199b3bcb96f79a1c3468cd7e7113739cf812c3221161d","dom_hash":"domhash607868ffe3517bc738efe7b20b96de10","first_seen":"2026-08-06T00:49:25.885335Z","last_seen":"2026-08-16T07:43:55.978838Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"172.67.220.100","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-20T02:38:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"srz.salesmartly.com","ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-07-22","domain_rank":378797,"first_seen":"2024-02-20T03:50:45Z","last_seen":"2026-08-12T03:17:28.57225Z","alert_count":0,"request_count":4,"received_data":2966,"sent_data":3066,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"plugin-code.salesmartly.com","ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2021-07-22","domain_rank":530835,"first_seen":"2024-12-12T08:03:04.74606Z","last_seen":"2026-08-13T17:26:51.411444Z","alert_count":0,"request_count":11,"received_data":1340700,"sent_data":6068,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"widget.salesmartly.com","ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-07-22","domain_rank":0,"first_seen":"2026-05-14T12:23:01.692825Z","last_seen":"2026-08-10T18:12:52.072884Z","alert_count":0,"request_count":2,"received_data":6496,"sent_data":1429,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"111.231.169.247","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-08-14T22:11:56.940153Z","alert_count":0,"request_count":1,"received_data":577,"sent_data":573,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2006-04-07","domain_rank":0,"first_seen":"2026-08-16T02:39:02.835535Z","last_seen":"2026-08-16T02:39:02.835535Z","alert_count":100,"request_count":25,"received_data":2004010,"sent_data":13988,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"msg.salesmartly.com","ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-07-22","domain_rank":360322,"first_seen":"2022-11-29T17:40:54Z","last_seen":"2026-08-10T18:12:52.012154Z","alert_count":0,"request_count":5,"received_data":3923,"sent_data":4358,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"api.ttsu-mall.shop","ip":{"addr":"104.21.7.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-27T17:58:03.475559Z","last_seen":"2026-05-29T09:22:27.422307Z","alert_count":0,"request_count":1,"received_data":893,"sent_data":627,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"client.salesmartly.com","ip":{"addr":"52.84.50.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2021-07-22","domain_rank":491526,"first_seen":"2024-06-25T09:52:15Z","last_seen":"2026-08-12T03:17:28.814267Z","alert_count":0,"request_count":2,"received_data":84970,"sent_data":1109,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}]},{"fqdn":"api.salesmartly.com","ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2021-07-22","domain_rank":387428,"first_seen":"2022-11-29T17:40:50Z","last_seen":"2026-08-13T17:26:51.390614Z","alert_count":0,"request_count":1,"received_data":855,"sent_data":772,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"mix-ads.oss-accelerate.aliyuncs.com","ip":{"addr":"47.254.187.140","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Germany","country_code":"DE"},"domain_registered":"2012-04-01","domain_rank":5285889,"first_seen":"2026-05-14T23:47:06.027768Z","last_seen":"2026-08-10T18:26:00.515853Z","alert_count":0,"request_count":1,"received_data":1049,"sent_data":670,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/chunk-vendors.7a18bc5f.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"68858237e334922290f783e204f35dce","sha1":"717dd13a47a18f30cf25199cd5735129063ba75f","sha256":"bb7ca93138e3d35e1597136c44ebe63d3968ee2333247ab349950c0d38abd859","sha512":"bdc360b025e65423832287c7dee817f93739f4e0278bbb13e575336e174a9c9bbea8bd39288f2b180ab7e51229e6f3fe968bd00cdb17457f3c41b5c22d143d90","ssdeep":"6144:OXtwTf3yPbMnnYKvENTlWbEvm/dO+Qh5V2viznm51/vxqnRuJwI6FK4Ikvy:OdwTfFnYkEtA3OIvizE0E0/Ikvy","tlshash":"e505f78df286b0b60ae730b5403f220bb2376959b40a84d4f675e4d4ad7894e6237f7d","size":829010,"data":"","first_seen":"2026-01-26T03:42:49.720514Z","last_seen":"2026-08-16T07:43:56.056835Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/install.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b66c28c86f7a748ad292827e42dce41a","sha1":"28a917632ced237bd795c1281b11b8290cb8da17","sha256":"84636d7f6fa124325a937f89a84a68dc04da016f26cab395437e5bf20ccf6c52","sha512":"8526b687f02e998d64e6d51225d856c9c20deb61981306d199f3288e6f5db88b6f71e1b0b45f4d43e7086817a3b3c46ef4f4b29b84077f92af1afc1c79c58f19","ssdeep":"","tlshash":"6a11d0c87ba378356389446b70bf865bb6b21441680c8000d19fe4a57828eb4c737e9c","size":1088,"data":"","first_seen":"2026-05-14T12:23:11.012383Z","last_seen":"2026-08-22T16:50:46.207791Z","times_seen":409,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-Cg9wJ54n.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"851396daca502cf14521cecb02aca66b","sha1":"bb13fe69b1452c392af9fcb5d6a0e8523f789053","sha256":"5c29248518f8aa0821cf4befa9c56db3d88f062e67c0efa695b1a38faaa6e7f0","sha512":"265b520f2bd1a731befe5ed42b45a93fd8e544c9a79a604ae8805319c5ecadac98c2164a47033bca294649e807252e8d1c22d7c9af04727856acaca9c665bac3","ssdeep":"768:PaBBRBSMFXGxkrCCIaPKvCz8zePMEccNeEMucEa6wPyCDYFDSTxhh+710STFR4ub:mv+w9126OIfFJSwRJFcTzA","tlshash":"43330ac9b691b06243ab60f0406f490af33a9925744c84a4f158dceb3db650edbb7f6d","size":52936,"data":"","first_seen":"2026-05-14T12:23:11.004494Z","last_seen":"2026-08-22T16:50:46.336134Z","times_seen":395,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/install.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3c06e8e0a224427c074ffb6c7de104f4","sha1":"11ff7a76084105b3497154af1cd7d5318386c0d2","sha256":"4ce82534967e063f78b2d8a7cdeb1d0f85316906feac29360d5f8d212c474fe3","sha512":"65f7e955ec2b9e01a1d18451624e29857615814070dcf61f2fae5f6b04916a6f2ec53287a2169600a60ceb4cf47b3f430f0abbcfb8db793f972118c3db48ce02","ssdeep":"192:cdoUYzvezFRvndgQCI2p3wf7LgaET/IUKe9uomy0dDrYntCKw9Lb26y2DdMiOAju:LUYzvezF5dtrLgjT/YdyykcB2HqhmnZp","tlshash":"ce32e8593427697992b80cc46079a311f6fd26633006d4a0f3bcceb9b555f8382b9eb9","size":10994,"data":"","first_seen":"2026-08-12T03:17:36.481104Z","last_seen":"2026-08-17T02:16:17.386039Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-P-0o5PGi.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"414612d0f626762dd4064a9d11f821c3","sha1":"1dfc6b06d8e4ca15ca986617d42e38eae947e94d","sha256":"39d68e743efe9cd9348cdd0e395ba726e43fba69c9288ca14554821d55969fe2","sha512":"87034b7526f8ef8dca2da1c61920e35f138214e42516e48057c3b39ee646a012685a924eb7155a60e8baef89aafc2ae9569f0d6e3635a3d812dfbeb95584d8fa","ssdeep":"384:5rlwqjdJMrxZ37t3XcCCcEvX5GG62NzbtJ5bOSKOjPComEWaj:tlwB329IBAbUbOjPComEWaj","tlshash":"d182b3c974eab58103927078153fa04bf1b37836556dc629a269d1defcbc08ee227d38","size":19114,"data":"","first_seen":"2026-05-14T12:23:11.031581Z","last_seen":"2026-08-22T16:50:46.169826Z","times_seen":393,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-YJ-x8pML.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f2a24589f72329295cd9954b8b82a78b","sha1":"3b1482bf7159d1e54a185a01cb2db86d259fdb02","sha256":"838e3b0575859be8808c4dce8ed176f31f15fbaa523acce88142092a0ea4d30f","sha512":"d576d5b01b5aeb6c4c9bf2c79a933542a273aa726b141d4cc40300f8ce6a6bf8d96a03061251763b8a1ad26fd582d3f17e00bb8ea1ddc43ea10170c7137b7a1b","ssdeep":"768:8E2fDPXd5rRshGxhh4j/qDyxpXajik2qrI/7a:8XDFB1D8ir+m","tlshash":"8433d8c4b1a120a543e7a1b1516f460a733fa82c554c816cb768daf22cbcdc97637fb9","size":50154,"data":"","first_seen":"2026-05-14T12:23:11.064394Z","last_seen":"2026-08-22T16:50:46.510405Z","times_seen":394,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/plugin-DZxWRE1E.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"418e4995aa8656b0575c1f8ef6e9115b","sha1":"f43d330c678fefd530bfe9b3bc116c67bc44ab57","sha256":"326e072e9d1a7a2eff4c44e4a8d7eb713ddf854bd3816ef073d1854002845a1c","sha512":"8624413e06f21ae318ddadcc3f9dd905b0e246446618c21c7cd4ec31d3b508d4f71ec47d49f47adef69aac26e6f115dcd4f29c6f45db358f02c01a0c53e86f74","ssdeep":"12288:Pesl7nAocT/FsH7kpZS43onCN7AzXZFBLbgOk0KNaQYaL1Cnr+WDMEwga7LRLP5x:mN1CrSVj5WqcTPY","tlshash":"d1c47c4df2a17876d3f2589090d20444626c0b7de01488e1f5bd9eb627b6da2e3b3b7d","size":545470,"data":"","first_seen":"2026-08-12T03:17:36.530709Z","last_seen":"2026-08-17T02:16:17.296733Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/index.22a1a162.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"661674827129667d132b2e5d94f276b2","sha1":"18bf5d4d99926bdf420eaf77699402853305f729","sha256":"24f3af76e25e1d0e00c1f7ae9bfe55d91f43484c0fb6f92eb158f42a2d594093","sha512":"a278127443f295ac8184e17b24c1a3b6e77b93877ac4679e874bf6e565f4198827fdc543acb54cf6ed5e9eb0b8b6631f34d6e469c5d0a9818d6641882d8d23a0","ssdeep":"3072:HTp8OSM24+PQFupBXDJaHMDkpI7Ah2YjSup6ZyDdpM0XiqpFMlZlGDmPWQ2XfBGm:wH4OQFuzJDke7Ah3D62vU0ETjquGGj6D","tlshash":"fa743c86b6c4147f4b864781e06f3fedf5bb0c728241e497d9d1bf391aca98a9105a3c","size":358533,"data":"","first_seen":"2026-08-06T00:34:21.288592Z","last_seen":"2026-08-16T07:43:56.003852Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/pages-account-index~pages-account-wallet~pages-home-index~pages-login-index~pages-login-register~pag~9d655afc.08ebe691.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"268fdd220356822ce6d151f4b3a2c892","sha1":"ebb3202c558d8ea1e850ed8eae19ba066d6e29de","sha256":"8180362378a7f4cfaef299c75b53092f9ac9829e5d1116a3771628ec1afc05f0","sha512":"1611c31d90a356b7e804783509006be4e09067f22e3d0691362f135dc0be2a736f54c44440b8621ac444bda07dd66f8c8bb3789ddf5096fe94471214737f6494","ssdeep":"192:zwzxPSY++VcvVk+8ym/UUmMOGHPjzSNflbMuA6Pa+0eollaNq1I:zCP8MSkJym/UUmRGHSNtbbA6KaNJ","tlshash":"0432fb18f0ca78610ae7902450bf1f0d503b3fad9574b9c9b7e5a4f64ae958c225fb38","size":11575,"data":"","first_seen":"2026-02-27T17:58:08.206407Z","last_seen":"2026-08-16T07:43:56.026617Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/#/","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"dcbd9715a5eee59dc08a7f7694f22db9","sha1":"38149a674151ba36f63cdd12543cdbb9d7f7dd27","sha256":"01d2361b054bb0ea43dc527da376197fc3ea0862e8c3ddb1d376a41ab118f28d","sha512":"8d05a492ee0be9137457f98fc59d846c0d032f6c3b1e4f6da18692961670ab9a62cfc82e06ada7fd45282cccba007ff51e00d96bee2099d027c935dc260453e0","ssdeep":"","tlshash":"7da024f737c314001511c37400473d545431041035dc4f0c404c7d710555170c337d0c","size":80,"data":"","first_seen":"2026-05-14T12:23:11.167523Z","last_seen":"2026-08-22T16:50:46.519076Z","times_seen":401,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/pages-account-bills~pages-account-deposit~pages-account-index~pages-account-message~pages-account-pa~0a2392ec.bf2d23c9.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"10e8cb59c3dfd5e25d0aa53cdbd42a0b","sha1":"c3c15e43fc80b9bb9180755616b9ab42a19cb12c","sha256":"7e1e86096b9ccc7dbb4d96322fa6fd2191321adc6556d2f7ff5eb50d080cb659","sha512":"f71f9e4b49f254621b75e9b3377b3c07b824c41b8e95d3c1fd8c1802accc0d6d8e02750a04acc154ea66d93c46aadd90c6b83b8ddd8ecebe589d4ae36701b833","ssdeep":"1536:DFTsYId0FHoMqu7NdEAaM2Ol51hwJX2RcJZHYpN7xCIx/+eJF4cL3nnisGQaOmvM:DJsp0NVr7fnaMj51hwJX2RcJZHYpN7xT","tlshash":"0443eae6e10c1cd17f7bcc8f6244235f6549ff62d9968cc8f126564c8de23a021a9b7a","size":55570,"data":"","first_seen":"2026-02-27T17:58:08.23347Z","last_seen":"2026-08-16T07:43:56.06214Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/pages-home-index.b5f64f36.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d13d417bdbe69e78a74c2a6f5ff8279c","sha1":"f6893d885f15f9c65cb0c374b067965777e1cf7a","sha256":"b9ed872418540f027c928d7f6f7fd198e9fddbff615ef70669388b2155915533","sha512":"ae392ccd528816ca80f645c8ee745e5c64af79d8bab5b43d7f435db934d60da9cb5a27c9ecab4e8b42e9f11faaaf856822ac9ef3830b48fb93efc3c3c3cc2ce9","ssdeep":"192:ItXBYyh/cDlqJRHen/kbL9h92A7fi1E5c7rAJrlFy2EZuzwW3TScbcLHtn:ItXBYyhfven/kFhz+fAJrlFy2iuzMQcF","tlshash":"5e827615b047b02e482fe421307f1a1490706f75d238e4eaeb76fd61cae8a9e3635b5d","size":18020,"data":"","first_seen":"2026-08-06T00:34:21.323459Z","last_seen":"2026-08-16T07:43:56.062947Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/js/project_728147_751822_1780039416.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"919e4203094c68e6ba4510f9edc5bdf5","sha1":"987ef2a033198842389b68122480bff83d7d351b","sha256":"c9dcdde5c9e2e1fe2a2e57a7687ab2367e0bbbeeed65c250bf4a4e29237670d0","sha512":"384bfd28cc7ea71f8fa03c77a81903590bed8baca55af1b2f373be39256a826b3007da368e142dd941aee27a2f837300b0a51330cec95b1bc23b14c34338af4c","ssdeep":"","tlshash":"9121cc471c6364757ad5717b4b3f88ad399991432004cc10bc4dd4681f909d10a5eee4","size":1187,"data":"","first_seen":"2026-06-05T02:03:32.23619Z","last_seen":"2026-08-16T07:43:56.047664Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-BO1BJI-2.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a1f0d3975c955fddf8c4b49ebe568407","sha1":"7b559dc893e3a59fe77d9553a8af7d6931f2e068","sha256":"85a50ac089309670d7b46e44d1ef17ab132599486ba995f6f12d07f72f4dd191","sha512":"e28c1ce7e3b1b762886f98bf8611a0b33a157c355a760d83602a75df917689c2013d51d4e52faa14445af13ec9bb6eed797f96db1ebd6a8bc8955c90289f1bdc","ssdeep":"1536:ffeY1Ph7WaDN38VCuXI3BDDAeP0/AKANwnntDi:fWYmahMqBDDAx/LANwntDi","tlshash":"507319e831a2b47113ea08e1507b0406f37d6845344ac4e9f5adaedf3e7641641abfbe","size":79629,"data":"","first_seen":"2026-05-14T12:23:11.157843Z","last_seen":"2026-08-22T16:50:46.311272Z","times_seen":394,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-BYcgX6J7.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"55bb175e22d7ea9f0d3f4815fa24c578","sha1":"d76864c11a42bff61779b52396d33ea99c46eb64","sha256":"8529f3d80f868c6f4121eab6a7b9f7ac6d19f89559502602cdaf2f91ad5ba614","sha512":"8fc39c6637e78fd48599026bec71361668175456a2b3d76a8eadf37f107bdbbc486feeead4ad200e9c628179b461c7eefb804222cb9a7619901e733b90d82de2","ssdeep":"1536:bzlbWdNzaNG6ZJgJdvJQ9CtXDTHEN4QC8AOgoAhWo1uVLxYnTUnfd5+k3:bzlxN6/tv84QC8AAAhr15TUnfd5+u","tlshash":"06b31cc47293b06643e324f4406f144af17dbc24548c9498f2a5e5eb7cb899e92bbf78","size":109345,"data":"","first_seen":"2026-05-14T12:23:11.144675Z","last_seen":"2026-08-22T16:50:46.380617Z","times_seen":393,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"client.salesmartly.com/js/marked/v14.1.2/marked.min.js","fqdn":"client.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"52.84.50.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4726c8d370952011c5137ee8e13eb6bb","sha1":"96c7a41fdc5d4530bb46f1a629f86ecaf068de82","sha256":"eeaba2c06a990d4602b4142cce579f4cce16fba404e6cc82c5c2f7ccb1e7bd1f","sha512":"6d7c814f6fec623660d43ef29034ba789484e0314354f247bdb4407dd7d82abe88bacac2cfbc009929b7eafcfd1bcccca1bdb946faaef74bdfb77248ef5ca071","ssdeep":"768:aH13NvoICzvRDEeJX2QLGbdpB+xJhuLPbBc5jI0sJMF2/bOCbnEytnbBOmVzFoso:aHOXo5ECPbBc5MB2A/blnEMRoaM","tlshash":"67f2094832ae3a6987d439e66cf81060e27f8e68344c545cf664f5f37c2690a61ebf70","size":36489,"data":"","first_seen":"2024-09-13T03:55:13Z","last_seen":"2026-08-22T16:50:46.509624Z","times_seen":2887,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"[YourCommerce] Application initialized successfully","filename":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/index.22a1a162.js","line_number":1,"column_number":28778},{"level":"log","text":"[YourCommerce] Application resumed","filename":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/index.22a1a162.js","line_number":1,"column_number":28995},{"level":"log","text":"[SafeCustomerService] Salesmartly 客服脚本加载成功，插件将显示原生“联系我们”按钮","filename":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/index.22a1a162.js","line_number":1,"column_number":241960}]},"http":[{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f2.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.040Z","timestamp":1786847909040,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f2.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-1099e\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n6jqGFyOum2JBKPcSZVCPdF564G5jZO7AcP5mBmOy1qoNrt2TkajOedplH4kFuR0wsY0NdHFmxpZsoctnCBAO1Yvy3Li3BsyTOj0QIPb3ySgGO8WCDqs5qS3%2Bakuw0Bkg%2FeIvpBH7ujGM%2F6XIysZlZ32fu2c6Jqw6g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277ee28deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67998\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67998,"size_decoded":68820,"mime_type":"image/png","magic":"PNG image data, 219 x 103, 8-bit/color RGB, non-interlaced","md5":"45919759c2838a6e98dab662c4558fad","sha1":"66701223f0ecb18b6c70567d2f4718da44631c8f","sha256":"1de27ea649b1c0c7e64d173c31c678b4d8bb0ee3fd8402d37a8aa046be639fd8","sha512":"359adf90828b19763f6e7d0afeeee30766f7062851f2d7835fa2e3f81c346e071521174091bef8cd6b1a46faf6b7ce644458a75a5bed1254b6c6087769e96c20","ssdeep":"768:lOHYJiCvQcYnmyfa9Wk9JVdeNussY8Qa6IhcOmc/BaEOjn40T3lWejcw:EHYIlcYnixpnf5Qa7p/en4Kgw","tlshash":"1c630b427f45e802e4651a768daac7ec2321fc885f26d38735d2ae3b7ded6c35c12284","first_seen":"2026-06-05T02:03:32.224822Z","last_seen":"2026-08-16T07:43:56.05865Z","times_seen":7,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"srz.salesmartly.com/client/log/log?plugin_sign=aad7c9df54cedeceb0f34f95a2f58635\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909718\u0026_lt=\u0026_u=\u0026_xma_=","fqdn":"srz.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.729Z","timestamp":1786847909729,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"srz.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 12 Jul 2026 16:59:55 GMT","end":"Sat, 10 Oct 2026 17:59:53 GMT"},"fingerprint":{"sha1":"27:93:BA:DA:50:AB:57:59:CE:78:C4:85:11:3D:A5:0C:CF:AE:87:BB","sha256":"69:85:C7:7F:1F:CA:99:12:24:04:AC:53:DA:7E:74:F0:7A:AB:18:6C:8B:DD:13:2C:B8:A6:B4:17:C2:0C:E6:AB"}}},"request":{"raw":"POST /client/log/log?plugin_sign=aad7c9df54cedeceb0f34f95a2f58635\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909718\u0026_lt=\u0026_u=\u0026_xma_= HTTP/1.1\r\nHost: srz.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 584\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:33 GMT\r\ncontent-type: application/json; charset=UTF-8\r\npriority: u=3,i=?0\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cpl, Agent-Cpl, Send-Cpl, Client-Type\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a2bd103f8fbe0b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47,"size_decoded":634,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"77e652f404f47086bb49598b43b92d9a","sha1":"9b4981aa40e98879d7f2efda3261e0f0c76a0d78","sha256":"052a4866127cab399192f6179141e92ce42742a7c09ccf7a0ffba2f0583869b5","sha512":"70e55dcdfca4754735386a3074c028d1047fce9b9d946cc84c2ea59d57799ffdc8071abc4c62142e2a1c319a948ad71eb696e0892bcaf1ce41f4616026a6bb63","ssdeep":"","tlshash":"bf900433341cc3470d05504f50053715d0f410500f104751ccfc0314430c4d57143410","first_seen":"2023-08-03T19:40:41Z","last_seen":"2026-08-22T16:50:46.376197Z","times_seen":2767,"resource_available":false,"data":null}},"time_used":3349,"timings":{"blocked":-1,"dns":6,"connect":1,"send":0,"wait":193,"receive":0,"ssl":3148},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msg.salesmartly.com/chat/chat-auto/user/trigger?login_token=bdd1f3f0373269f478ae942b84410429\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026plugin_sign=6a09294cfad91aadb48bdfcbed47b1f4\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847911149\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147","fqdn":"msg.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:31.162Z","timestamp":1786847911162,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msg.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 04:24:42 GMT","end":"Thu, 15 Oct 2026 05:24:40 GMT"},"fingerprint":{"sha1":"9E:33:85:67:70:1B:4F:B8:D1:EB:68:05:5F:92:57:7D:A2:27:69:7F","sha256":"EE:2F:33:B2:9D:C2:BA:37:C5:7A:B8:FA:32:C5:6E:B9:4A:8F:AC:F2:D6:7F:41:1F:95:C2:0F:C1:C8:63:5F:FD"}}},"request":{"raw":"POST /chat/chat-auto/user/trigger?login_token=bdd1f3f0373269f478ae942b84410429\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026plugin_sign=6a09294cfad91aadb48bdfcbed47b1f4\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847911149\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147 HTTP/1.1\r\nHost: msg.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 13\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":13,"data":"is_new_user=1"}},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:31 GMT\r\ncontent-type: application/json\r\ncf-ray: a2bd1034c9763181-OSL\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nserver: cloudflare\r\nvary: accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT, Keep-Alive, User-Agent, Cache-Control, Content-Type, Authorization, Origin, Cpl, Client-Type, X-Requested-With, Accept, External-Sign\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\nx-request-id: a731dad1-1dc1-4c55-a100-421fc494eedb\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36,"size_decoded":740,"mime_type":"application/json","magic":"JSON text data","md5":"6b210154a96c28a41ffbe341a228c02a","sha1":"2e5751bde9f2323a79989d165f22ba111624ab76","sha256":"57109c9877bb6690c6284c7b2b98088071ee4762449b6b5659dd908bf9d703e3","sha512":"16fc9ff07ff4e167be6b24dad448fe7479cb1e5b50d5e7f251c84852e4c67d8caff68a1eae5be69b8f4561d97bc6d41be026597033718181025b3a97c7e292fe","ssdeep":"","tlshash":"89800023282c2c830e0238cc880e8b8820e820808e200330cc8ca228cb080a8ba82830","first_seen":"2023-06-30T01:11:08Z","last_seen":"2026-08-22T16:50:46.186737Z","times_seen":2291,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-16T02:38:26.556Z","timestamp":1786847906556,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Thu, 23 Jul 2026 02:52:42 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XnhjrWeq1QSA2609ayzKEPDqBh1FdU0%2FQmb52ATTiYvG07kGMYcSrQW1Sa0uie71kdh3LdxfXtMaLcbGe3IY1Fwv5ELK1sL%2BG93uZVQnb9gVFFQrLR3EcAPtpm%2FkYQJSK94jN7ApL97W8RTFbYGEgC4dMwQmDuomsw%3D%3D\"}]}\r\nstrict-transport-security: max-age=31536000\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: zstd\r\ncf-ray: a2bd101cff4b1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":527,"size_decoded":1013,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (527), with no line terminators","md5":"d3415880f7c5db1fa2a2008b0ea82c16","sha1":"b3f7b37676272c3b406ec09beeffcc1683927527","sha256":"ca38bac75f10e8354a56210271f8ad9a720cd5d88cc9e106a6d0164f9e65a319","sha512":"fb2a83b2be0230ab9d0422f3b2e8392070d1e3b5a3954dadae55d544dddd947d00fe7f1ce5261b80b27c104675efc915f96c44ce177e3b28cda7a060577b23ba","ssdeep":"","tlshash":"26f0c9874c20c42e2b304a5089b9f66c49cad86dfa304ca069e425ec4be47cc8dbf448","first_seen":"2026-08-16T02:39:07.849004Z","last_seen":"2026-08-16T07:43:56.056076Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1619,"timings":{"blocked":-1,"dns":787,"connect":1,"send":0,"wait":819,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/index.22a1a162.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.369Z","timestamp":1786847908369,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/js/index.22a1a162.js HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a617cb0-57885\"\r\nexpires: Sun, 16 Aug 2026 04:27:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 36674\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WZ9dcVHnptxojs5OUZ1eh1fnyB12tOO5qe4LMlT%2BltRdE%2FGwjcjkV0ZMejVVL6%2FVOplYhIQ08Gg3JsgD6H7Keek3tu2fVMr22uZdoCiEodC9c%2Fqmb%2Bem3TpZNYeJGvbRKM9R7EocM8Fc2z5tA%2FJ7XwbS%2Foy6HowQgA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2bd10234e1f8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":358533,"size_decoded":111644,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64978), with no line terminators","md5":"661674827129667d132b2e5d94f276b2","sha1":"18bf5d4d99926bdf420eaf77699402853305f729","sha256":"24f3af76e25e1d0e00c1f7ae9bfe55d91f43484c0fb6f92eb158f42a2d594093","sha512":"a278127443f295ac8184e17b24c1a3b6e77b93877ac4679e874bf6e565f4198827fdc543acb54cf6ed5e9eb0b8b6631f34d6e469c5d0a9818d6641882d8d23a0","ssdeep":"3072:HTp8OSM24+PQFupBXDJaHMDkpI7Ah2YjSup6ZyDdpM0XiqpFMlZlGDmPWQ2XfBGm:wH4OQFuzJDke7Ah3D62vU0ETjquGGj6D","tlshash":"fa743c86b6c4147f4b864781e06f3fedf5bb0c728241e497d9d1bf391aca98a9105a3c","first_seen":"2026-08-06T00:34:21.288592Z","last_seen":"2026-08-16T07:43:56.003852Z","times_seen":6,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.ttsu-mall.shop/index/index?lang=en","fqdn":"api.ttsu-mall.shop","domain":"ttsu-mall.shop","tld":"shop"},"ip":{"addr":"104.21.7.149","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.024Z","timestamp":1786847909024,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ttsu-mall.shop","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 22 Jul 2026 22:02:22 GMT","end":"Tue, 20 Oct 2026 23:02:08 GMT"},"fingerprint":{"sha1":"F9:F2:38:66:23:41:67:CB:A4:0F:AB:64:67:E9:38:7A:81:92:14:59","sha256":"58:44:8F:9F:9B:AB:C4:27:A6:9F:75:A4:75:48:A2:F5:EF:7A:8C:CB:17:77:18:73:CB:5D:65:F7:A3:B4:09:33"}}},"request":{"raw":"OPTIONS /index/index?lang=en HTTP/1.1\r\nHost: api.ttsu-mall.shop\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,content-type\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Requested-With, Content-Type, Accept, Authorization, User_id\r\naccess-control-allow-credentials: true\r\nstrict-transport-security: max-age=31536000\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=e2c5Jj39SHDlb5DzITxltiBPHD8aj9kixp%2Bm%2FCSdI41puTIucXh77gr1Grp1us8OqIAKeIyB8HMus1ax3aNAYZIO3z6KURIal%2B%2Bdwgxtfe6UW3n0rpCpck2nT0C6yah9qWWlR2o%3D\"}]}\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2bd1027ac5a1525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":902,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":763,"timings":{"blocked":-1,"dns":33,"connect":16,"send":0,"wait":713,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/index.ed4a2d2b.css","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.365Z","timestamp":1786847908365,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/index.ed4a2d2b.css HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a617cb0-1794e\"\r\nexpires: Sun, 16 Aug 2026 04:27:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 36674\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=krHzvdCkR0tS%2FRwueLbMuSNndy%2BWBErJ99yibYjglchK8Md%2F7LrfF2YFwJMdilPHL8bycTDut3bH7lXSB6KLTXpshvnmS4cfj48XYmThWsWPcyq5be1PvT06lVc3OKDAQFbFMoh6k2T4biXqU2%2B07RdqKojgFBYAXg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2bd10234e1d8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96590,"size_decoded":30589,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d2c05a28c7f2113821d909b7b5b918a3","sha1":"ccac94311f6ac6f580b64f47f7705318f1d226a3","sha256":"695bdbeea38a126c139158967cdd4f3a435e9936b9dff5b002e5f20a10fc7907","sha512":"3b96fbd1a89be8ae0b7479705cd4a2958ffe7f2f3f57ec23f407ad51ed8b447b9960728d77502e8fd8b2b19bf0971682030117559df250ea11c9bc1802364c3c","ssdeep":"1536:qlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nrhlvbc:hApuK7hmVrS1Wu3iG41nrPI","tlshash":"4493f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2025-10-16T12:28:28.877032Z","last_seen":"2026-08-22T19:31:56.980818Z","times_seen":1840,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/icon_box_2.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.036Z","timestamp":1786847909036,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/icon_box_2.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-124f\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VO3JFVHbnZx5PTrb39Wgf%2BJxEIRJ9yp8heZBD%2BZXi2BwzPWVIDvXDenRONJUSvekH2baN6%2Fsd%2BYk9hiqXN5Mp7%2FwXr2gCEClD6hYeNoI6CcRhHgOihPs3zbzO7aG5isc%2FSfA7WvMfdEfYvuFWYEOTjoEXXkfO3u9ow%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277ede8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4687\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4687,"size_decoded":5513,"mime_type":"image/png","magic":"PNG image data, 193 x 192, 8-bit/color RGBA, non-interlaced","md5":"3cfe19ee2948dc3d801afc4b6c25339f","sha1":"1e908d24b3bb21908191a504c74ee0be3e3a4d2c","sha256":"e71399ca790a567d6f46af5c957a8a4fbd3631a19f9d7c527cc82e57a4048cfe","sha512":"5632e7dff15dfc0b4f46526316d8ae3c432186f1d93c09ca3705c119eee3403fff465bd928c4858de2c8df0ab25588ba8072ca07f91b54b7d5c373292676d2b3","ssdeep":"96:BGTOMOPApcEyL+sCKjU1gjfe/2dYwZveG9evGEHK1:wT2YpcVdbc2dYwZveKetq1","tlshash":"aba18ef8b661c7fdb42d39b13a922c4bf51914c709e88f0eda4e4d5c908bd08d537682","first_seen":"2024-08-19T16:11:10.100895Z","last_seen":"2026-08-21T05:10:27.169398Z","times_seen":654,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-YJ-x8pML.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.445Z","timestamp":1786847909445,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/js/chunk-common-YJ-x8pML.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Sat, 15 Aug 2026 14:34:42 GMT\r\nx-oss-server-time: 5\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A8079027859E4393555C1F5\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT\r\naccess-control-expose-headers: x-oss-request-id, ETag\r\naccess-control-max-age: 600\r\nlast-modified: Tue, 11 Aug 2026 09:34:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 12708522076119217507\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: 8qJFifcjKSlc2ZVLi4Kniw==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3fef473b9069c3a6b17fb47d4e1f2460.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: L5rkvIvN7Kh6YTrLdhd8daw2OxsvB3cROoekwEmoaIGrEuXyFDCbVQ==\r\nage: 43426\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":50154,"size_decoded":16350,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (25425)","md5":"f2a24589f72329295cd9954b8b82a78b","sha1":"3b1482bf7159d1e54a185a01cb2db86d259fdb02","sha256":"838e3b0575859be8808c4dce8ed176f31f15fbaa523acce88142092a0ea4d30f","sha512":"d576d5b01b5aeb6c4c9bf2c79a933542a273aa726b141d4cc40300f8ce6a6bf8d96a03061251763b8a1ad26fd582d3f17e00bb8ea1ddc43ea10170c7137b7a1b","ssdeep":"768:8E2fDPXd5rRshGxhh4j/qDyxpXajik2qrI/7a:8XDFB1D8ir+m","tlshash":"8433d8c4b1a120a543e7a1b1516f460a733fa82c554c816cb768daf22cbcdc97637fb9","first_seen":"2026-05-14T12:23:11.064394Z","last_seen":"2026-08-22T16:50:46.510405Z","times_seen":394,"resource_available":true,"data":null}},"time_used":35,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/icon_box_3.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.037Z","timestamp":1786847909037,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/icon_box_3.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-1073\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4v%2BLJSxX9Nt25kwt8ni%2B91cD8KJq14yDka8Q50YE6h2zGxK6wH7fRbI4gvdreWswjSx62qHVZiXPQf95AWhjYXqf%2Fng%2FGxu14KGttEK5YbiT4m%2FnNgjDghvX1NGF9s4ewpvmMwRPXyOcFhZrENnLLEvBBohB1%2BrdFQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277edf8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4211\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4211,"size_decoded":5037,"mime_type":"image/png","magic":"PNG image data, 193 x 192, 8-bit/color RGBA, non-interlaced","md5":"d4f8979b3d4018df19969be9034516f9","sha1":"cd6ed110c7796e771450e27e820b11f7940d9db6","sha256":"636491d3bb271b7114c8cc3a8b05577949318e025acbd978f644fa1dd449cc76","sha512":"5eb075dab8c90cf6592176262d7e57350575022e4a30301766231aa51bc316b768d7a8dce2098b3012f75e27196978d849ab72eca032641e8a5eda5432b778be","ssdeep":"96:ZEHnswxASzLSucX8QAu1V3H80aqpuT3ktzXPFmEtvaXyHcSxBEchT:ZQn3WSMyu1Vs0bUIXtpIdSxBEQT","tlshash":"bf915dd3d557f081e311e27e0d3410e85519a6edc731a448eee7ec1e7a2ba99426d170","first_seen":"2024-08-19T16:11:10.099878Z","last_seen":"2026-08-21T05:10:27.214256Z","times_seen":650,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/favicon.ico","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.717Z","timestamp":1786847909717,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:30 GMT\r\ncontent-type: text/html\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cEL3afg3mlnX9vCaDvIGmxvE79JBEp5t%2BLVBiLlUK8QL3FnvwYBaxyttvz9qO28rOror3U4RHU6xmGdWenxSfWfw12wn6BlQ%2FkIyuC1iHjzwKv2Tag5S4oCirH3d4urQES4qwB0wSK85imz7ZIdT%2BSHYpj4FS3L7lA%3D%3D\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=6,i=?0\r\ncf-ray: a2bd102bbf098deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":146,"size_decoded":743,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-22T23:21:44.859069Z","times_seen":553181,"resource_available":true,"data":null}},"time_used":699,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":699,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/tabbar/record.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.696Z","timestamp":1786847908696,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/tabbar/record.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-261\"\r\nexpires: Mon, 14 Sep 2026 16:27:21 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36667\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dyF4S51%2BbnordQRu%2F4oU7rmSJJMyHO%2Bjy%2F%2Fs%2BaJA%2B6sc9iE0xuOx02XlMTkZgMEvF%2Bd7vIuuhfU05RskADamoArABw%2F1jdayHz49hlFmA%2FuAkIynerldnmrUn2gc6YOtWj4yHOLgX6gD%2BO2dwt4Ix7gKf04HrqXkAQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a2bd10255ecd8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 609\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":609,"size_decoded":1443,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"dbc5830013c22fc3ca6449f4a588a328","sha1":"8c64990eb58feeae07f82c80a25dab9afc1e0265","sha256":"de4238198df876d91cc490560d711203a414e2e5b67106206bef2411fec7728d","sha512":"4838837e1566b8d1cf356c7371fe083546357973c205ad4c88fdfc750499c3cf9f73705926e2e9917f9b6b1c539f5cf5ad2d5d44cfe651f209959b8299784dfd","ssdeep":"","tlshash":"a2f0b7937326fca08b3b94f7a854045a80391a5fdce6c6070f8463b41c33cb1441aa02","first_seen":"2025-08-11T17:15:18.623331Z","last_seen":"2026-08-16T07:43:56.110578Z","times_seen":81,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"srz.salesmartly.com/client/log/log?plugin_sign=80e342dba58799094305126e139b143d\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909720\u0026_lt=\u0026_u=\u0026_xma_=","fqdn":"srz.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.731Z","timestamp":1786847909731,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"srz.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 12 Jul 2026 16:59:55 GMT","end":"Sat, 10 Oct 2026 17:59:53 GMT"},"fingerprint":{"sha1":"27:93:BA:DA:50:AB:57:59:CE:78:C4:85:11:3D:A5:0C:CF:AE:87:BB","sha256":"69:85:C7:7F:1F:CA:99:12:24:04:AC:53:DA:7E:74:F0:7A:AB:18:6C:8B:DD:13:2C:B8:A6:B4:17:C2:0C:E6:AB"}}},"request":{"raw":"POST /client/log/log?plugin_sign=80e342dba58799094305126e139b143d\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909720\u0026_lt=\u0026_u=\u0026_xma_= HTTP/1.1\r\nHost: srz.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 642\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:33 GMT\r\ncontent-type: application/json; charset=UTF-8\r\npriority: u=3,i=?0\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cpl, Agent-Cpl, Send-Cpl, Client-Type\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a2bd1040cff80b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47,"size_decoded":634,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"77e652f404f47086bb49598b43b92d9a","sha1":"9b4981aa40e98879d7f2efda3261e0f0c76a0d78","sha256":"052a4866127cab399192f6179141e92ce42742a7c09ccf7a0ffba2f0583869b5","sha512":"70e55dcdfca4754735386a3074c028d1047fce9b9d946cc84c2ea59d57799ffdc8071abc4c62142e2a1c319a948ad71eb696e0892bcaf1ce41f4616026a6bb63","ssdeep":"","tlshash":"bf900433341cc3470d05504f50053715d0f410500f104751ccfc0314430c4d57143410","first_seen":"2023-08-03T19:40:41Z","last_seen":"2026-08-22T16:50:46.376197Z","times_seen":2767,"resource_available":false,"data":null}},"time_used":3553,"timings":{"blocked":-1,"dns":5,"connect":1,"send":0,"wait":194,"receive":0,"ssl":3351},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/tabbar/account.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.699Z","timestamp":1786847908699,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/tabbar/account.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-381\"\r\nexpires: Mon, 14 Sep 2026 16:27:21 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36667\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1h2aqT54uqdD0gosCphJkRs82E%2F0A8E%2BKoJnAUPY2D8p%2F8c%2F86vVKsLbHoz78T9xCUxZgWX6P1SdWMH09jeEPok8XwQoQqON72uaCZ6K%2BLdDE6tqknHbzy48sshgx8V59s7exGPTKX6EWHD3v4OWLyiPVRpAFNctPQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a2bd10255ecf8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 897\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":897,"size_decoded":1719,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"22efb4d5304c2a4a9ade526451e40a24","sha1":"9ca4ca4ee8e5d8d841c83fd638d6a0ed8742b143","sha256":"7a1936376e28d918f93463cdbe792da24ce8cb40ce017c1cbbcb3f54b2e0f1b8","sha512":"a10792e46dd0975ea1046f588df6308724b105dcb958f703c8064b4971d67b36e58cdab11e1347bf9bd30ebcbf02c1a75dbdf0ad4c31fa0fead33766eb0bfeb0","ssdeep":"","tlshash":"9911e6fb13850028e274282b64a23745ea9798f8027fc07b0c4084f3e91b8bc80e3c0e","first_seen":"2025-08-11T17:15:18.625211Z","last_seen":"2026-08-16T07:43:56.018995Z","times_seen":81,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/install.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.239Z","timestamp":1786847909239,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/install.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Tue, 11 Aug 2026 09:00:06 GMT\r\nx-oss-server-time: 7\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A7AE4967859E43737FA25AD\r\nlast-modified: Tue, 11 Aug 2026 08:59:38 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 15204050908943186341\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=600\r\ncontent-md5: tmwoyG96dIrSkoJ+QtzkGg==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 0ca3a24436a7d86916b35130b21285a8.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: 2ugd5hD5RGWqAUfWVf665MQ9p4hOPPR2A4Gv0d5aNy28JCQvQIH-_g==\r\nage: 409103\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1088,"size_decoded":1261,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1087)","md5":"b66c28c86f7a748ad292827e42dce41a","sha1":"28a917632ced237bd795c1281b11b8290cb8da17","sha256":"84636d7f6fa124325a937f89a84a68dc04da016f26cab395437e5bf20ccf6c52","sha512":"8526b687f02e998d64e6d51225d856c9c20deb61981306d199f3288e6f5db88b6f71e1b0b45f4d43e7086817a3b3c46ef4f4b29b84077f92af1afc1c79c58f19","ssdeep":"","tlshash":"6a11d0c87ba378356389446b70bf865bb6b21441680c8000d19fe4a57828eb4c737e9c","first_seen":"2026-05-14T12:23:11.012383Z","last_seen":"2026-08-22T16:50:46.207791Z","times_seen":409,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":0,"dns":18,"connect":8,"send":0,"wait":9,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-P-0o5PGi.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.444Z","timestamp":1786847909444,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/js/chunk-common-P-0o5PGi.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Sat, 15 Aug 2026 14:34:43 GMT\r\nx-oss-server-time: 2\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A8079030900E633314D7BCF\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT\r\naccess-control-expose-headers: x-oss-request-id, ETag\r\naccess-control-max-age: 600\r\nlast-modified: Tue, 11 Aug 2026 09:34:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 17389672731008990191\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: QUYS0PYmdi3UBkqdEfghww==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3fef473b9069c3a6b17fb47d4e1f2460.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: CBZ_gLTNhV-xflgGSNkaABIxhS8xjQRtguM5fF9ScnPuAbl9_EYdcw==\r\nage: 43426\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":19114,"size_decoded":7683,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19113)","md5":"414612d0f626762dd4064a9d11f821c3","sha1":"1dfc6b06d8e4ca15ca986617d42e38eae947e94d","sha256":"39d68e743efe9cd9348cdd0e395ba726e43fba69c9288ca14554821d55969fe2","sha512":"87034b7526f8ef8dca2da1c61920e35f138214e42516e48057c3b39ee646a012685a924eb7155a60e8baef89aafc2ae9569f0d6e3635a3d812dfbeb95584d8fa","ssdeep":"384:5rlwqjdJMrxZ37t3XcCCcEvX5GG62NzbtJ5bOSKOjPComEWaj:tlwB329IBAbUbOjPComEWaj","tlshash":"d182b3c974eab58103927078153fa04bf1b37836556dc629a269d1defcbc08ee227d38","first_seen":"2026-05-14T12:23:11.031581Z","last_seen":"2026-08-22T16:50:46.169826Z","times_seen":393,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-BYcgX6J7.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.489Z","timestamp":1786847909489,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/js/chunk-common-BYcgX6J7.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-Cg9wJ54n.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Sat, 15 Aug 2026 14:34:43 GMT\r\nx-oss-server-time: 6\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A8079030A7E1F30389C8273\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT\r\naccess-control-expose-headers: x-oss-request-id, ETag\r\naccess-control-max-age: 600\r\nlast-modified: Tue, 11 Aug 2026 09:34:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 16134971315845804156\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: VbsXXiLX6p8NP0gV+iTFeA==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3fef473b9069c3a6b17fb47d4e1f2460.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: LXPELZHu3So-raGXslLOV3SvReJuKn2UJE1GZo_Y8ud6AUBR9wysxg==\r\nage: 43426\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":109345,"size_decoded":39307,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"55bb175e22d7ea9f0d3f4815fa24c578","sha1":"d76864c11a42bff61779b52396d33ea99c46eb64","sha256":"8529f3d80f868c6f4121eab6a7b9f7ac6d19f89559502602cdaf2f91ad5ba614","sha512":"8fc39c6637e78fd48599026bec71361668175456a2b3d76a8eadf37f107bdbbc486feeead4ad200e9c628179b461c7eefb804222cb9a7619901e733b90d82de2","ssdeep":"1536:bzlbWdNzaNG6ZJgJdvJQ9CtXDTHEN4QC8AOgoAhWo1uVLxYnTUnfd5+k3:bzlxN6/tv84QC8AAAhr15TUnfd5+u","tlshash":"06b31cc47293b06643e324f4406f144af17dbc24548c9498f2a5e5eb7cb899e92bbf78","first_seen":"2026-05-14T12:23:11.144675Z","last_seen":"2026-08-22T16:50:46.380617Z","times_seen":393,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/pages-account-index~pages-account-wallet~pages-home-index~pages-login-index~pages-login-register~pag~9d655afc.08ebe691.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.661Z","timestamp":1786847908661,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/js/pages-account-index~pages-account-wallet~pages-home-index~pages-login-index~pages-login-register~pag~9d655afc.08ebe691.js HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a617cb0-2d37\"\r\nexpires: Sun, 16 Aug 2026 04:27:21 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 36667\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0MLY1QFOLHIaxqDUuVgJe%2BSBP16r0k6sFoKVSWj0dNrwaZ9i5hnhNLpjj4bVXpRHZoRwRK7xgIrLxpGazpWAaiN65CfvjDAVaLDImPXe%2BXPD0%2BKtRP9%2BH%2BjX1YLOAQ0QWUH98%2F0vLIMANnYqCCe%2FRzLBQ5ODltfcDg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2bd10251ec38deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11575,"size_decoded":4313,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11363), with no line terminators","md5":"268fdd220356822ce6d151f4b3a2c892","sha1":"ebb3202c558d8ea1e850ed8eae19ba066d6e29de","sha256":"8180362378a7f4cfaef299c75b53092f9ac9829e5d1116a3771628ec1afc05f0","sha512":"1611c31d90a356b7e804783509006be4e09067f22e3d0691362f135dc0be2a736f54c44440b8621ac444bda07dd66f8c8bb3789ddf5096fe94471214737f6494","ssdeep":"192:zwzxPSY++VcvVk+8ym/UUmMOGHPjzSNflbMuA6Pa+0eollaNq1I:zCP8MSkJym/UUmRGHSNtbbA6KaNJ","tlshash":"0432fb18f0ca78610ae7902450bf1f0d503b3fad9574b9c9b7e5a4f64ae958c225fb38","first_seen":"2026-02-27T17:58:08.206407Z","last_seen":"2026-08-16T07:43:56.026617Z","times_seen":8,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f5.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.044Z","timestamp":1786847909044,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f5.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-1099e\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uyfKKOLP6X9PmCSCJE115UJqidiYUpZwzA%2FBKqIZNwuDWhQu7iFdDZ5cj7HeLv2C0PYZuqODqknh%2F1aJ77cIrglmRW5%2F4gEFQ0GPagwM4MCF8E%2B0iOfEvhE%2BXRcfYVq81jUVNfhP8oCgmtPmDyF366YL%2Bh44rKqsHg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10278ee58deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67998\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67998,"size_decoded":68826,"mime_type":"image/png","magic":"PNG image data, 219 x 103, 8-bit/color RGB, non-interlaced","md5":"a3a11f38e55c5da87d1deb79e06e0ba2","sha1":"bbce63b2db18b7a8503ebf54214f476e357c995a","sha256":"cdf311e466e9dc39a86cafa0f93a966a9f2e2b5e1283637f83d64291381ff66d","sha512":"64e852a203b99b5a2ad87634e250371c57935179bc9272813a1f85ece7dd1c5e72923f5e658fb27002c855c81ee16f35807b155c5ff8a85cc28d69f17976bd99","ssdeep":"768:lkEmMXOz/vxwOcqGOJgRHZrRV94bqruFPilff0HA+jeKidUrrfO/NAj:WEm4CH2OcqfJgRkGrcPilEXjeZdQfiAj","tlshash":"d2636053bf09e812d4541e758876c7e82334fc496f22934734dabe7faeae2d28c15254","first_seen":"2026-06-05T02:03:32.195186Z","last_seen":"2026-08-16T07:43:56.025319Z","times_seen":7,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f6.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.047Z","timestamp":1786847909047,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f6.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-10ad3\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dycn0BVGJrp2JEMT6ZJrJul4KspCl0AuC7CWce4WQRC7vLN78seZZqObArx9dQr4Fa57Hv9Iu%2FRz1E%2FpV%2BOPFHJ%2FhrhfiVrd0x6%2BTCgAToUkTSG1o05A4HHsXdWagM7MXQgzgD0r%2Brvqdz96zn2vkmnnelnJ4dFWMA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10278ee68deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 68307\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68307,"size_decoded":69135,"mime_type":"image/png","magic":"PNG image data, 220 x 103, 8-bit/color RGB, non-interlaced","md5":"9c1a52192b7d6ae0afbdc2734bb69af1","sha1":"72d2a000b815a7723fb67a0e5754a0a32015d888","sha256":"3f77620cb11e462a71203b391672d0c273c1de66ee1b394187c473395d7b52a6","sha512":"f0567d0b230448b341d609795e495d886224c593c614c893677b4308a9c356b5d3c2d8caae6e9007142ce6ed514b6d3f4617018b4a52b356cde7fb3ae771e9ba","ssdeep":"384:7y/odkZRY4859cwJeCafO7EZEFMupoEJ9+hVNKvz:7y/kkvY4+9cOeCaW7EK1pou9+hVNKvz","tlshash":"aa638612bf45e403d8682e768a75c7e86321fc48af22934734d67f6fadae2c24d12354","first_seen":"2026-06-05T02:03:32.185704Z","last_seen":"2026-08-16T07:43:56.105424Z","times_seen":7,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"client.salesmartly.com/setting/sounds/ling.mp3","fqdn":"client.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"52.84.50.5","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.391Z","timestamp":1786847909391,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /setting/sounds/ling.mp3 HTTP/1.1\r\nHost: client.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\ncontent-type: audio/mp3\r\ncontent-length: 47223\r\ndate: Thu, 13 Aug 2026 03:46:02 GMT\r\nx-amz-replication-status: REPLICA\r\nlast-modified: Tue, 02 Jul 2024 06:29:42 GMT\r\netag: \"1065fe976ff9e98d69772fe0f0d7b808\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public, max-age=15552000\r\nx-amz-version-id: J6b7RzocQsVXwTzS3QxevgOr1gKTyblY\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ncontent-range: bytes 0-47222/47223\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 d229ccc15dd984a81023d1b57fa0adbc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P3\r\nx-amz-cf-id: QWmJldWc8uTY_W2VhNB6UJlI0H2fQJWzlzlsFXoAuhTSEmV2nR1Vsw==\r\nage: 255148\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":47223,"size_decoded":47882,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 192 kbps, 48 kHz, JntStereo","md5":"1065fe976ff9e98d69772fe0f0d7b808","sha1":"122193fafe8453db01635cf4502524eb93264fdc","sha256":"35fbb2ad61551e3a396591657a66b563222454418238c46005b89418556f9983","sha512":"7d0de1b98c66aaa939f56253d100f5efc36128c2b8420fc8c932f68873a643a1179411a9410125aa3ff5512f74dad1209f2e19c5a0734d4582c5b94280e242a7","ssdeep":"384:ju+iqqxhBRBJ2zjBQRB57Nsyf+/C6ufaPkm5NyxGo5Vtll9rFd1ft7FDehm:junhJdlac","tlshash":"00239434b6a108d0e14eaaffb0deb2121e771ec3cd56a84075ef78044fb1179255b8b6","first_seen":"2023-04-19T11:38:49Z","last_seen":"2026-08-22T16:50:46.411951Z","times_seen":3405,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":2,"connect":1,"send":0,"wait":3,"receive":1,"ssl":6},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-Cg9wJ54n.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.441Z","timestamp":1786847909441,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/js/chunk-common-Cg9wJ54n.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Sat, 15 Aug 2026 14:34:42 GMT\r\nx-oss-server-time: 2\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A8079025F471E3139566067\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT\r\naccess-control-expose-headers: x-oss-request-id, ETag\r\naccess-control-max-age: 600\r\nlast-modified: Tue, 11 Aug 2026 09:34:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 11117890345216515431\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: hROW2spQLPFFIc7LAqymaw==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3fef473b9069c3a6b17fb47d4e1f2460.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: YHeW4E2eXHyUY1n5lbFPoX6vGXQb2TbYo80GFhg-KWJfzlUAcdZxJw==\r\nage: 43426\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":52936,"size_decoded":20357,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13923)","md5":"851396daca502cf14521cecb02aca66b","sha1":"bb13fe69b1452c392af9fcb5d6a0e8523f789053","sha256":"5c29248518f8aa0821cf4befa9c56db3d88f062e67c0efa695b1a38faaa6e7f0","sha512":"265b520f2bd1a731befe5ed42b45a93fd8e544c9a79a604ae8805319c5ecadac98c2164a47033bca294649e807252e8d1c22d7c9af04727856acaca9c665bac3","ssdeep":"768:PaBBRBSMFXGxkrCCIaPKvCz8zePMEccNeEMucEa6wPyCDYFDSTxhh+710STFR4ub:mv+w9126OIfFJSwRJFcTzA","tlshash":"43330ac9b691b06243ab60f0406f490af33a9925744c84a4f158dceb3db650edbb7f6d","first_seen":"2026-05-14T12:23:11.004494Z","last_seen":"2026-08-22T16:50:46.336134Z","times_seen":395,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"widget.salesmartly.com/plugin/info?language=en-US\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909713\u0026_lt=\u0026_u=\u0026_xma_=","fqdn":"widget.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.724Z","timestamp":1786847909724,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"widget.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Jun 2026 17:24:38 GMT","end":"Wed, 23 Sep 2026 18:24:36 GMT"},"fingerprint":{"sha1":"68:24:AA:01:FE:7C:74:44:2D:65:E9:35:7B:E9:90:1B:B6:1A:F5:FE","sha256":"36:B9:DE:DB:E9:14:9C:92:9B:DB:B9:F9:98:FB:47:A8:7B:41:C3:86:81:D4:1C:61:2F:BE:FB:FC:2E:54:74:D9"}}},"request":{"raw":"GET /plugin/info?language=en-US\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909713\u0026_lt=\u0026_u=\u0026_xma_= HTTP/1.1\r\nHost: widget.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nexternal-sign: 91c1dea543f26e0b6b64edfdf0ad32fb\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:30 GMT\r\ncontent-type: application/json; charset=utf-8\r\npriority: u=3,i=?0\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization,Origin,Cpl,Client-Type,X-Requested-With,Accept,External-Sign\r\naccess-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, UPDATE\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-expose-headers: Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Cache-Control, Content-Language, Content-Type\r\nserver: cloudflare\r\nx-request-id: 1e922c68-cea6-415a-a5ec-c1a56d2cb58e\r\ncf-cache-status: DYNAMIC\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncontent-encoding: br\r\ncf-ray: a2bd102d1f62723c-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4899,"size_decoded":2790,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"da900c0be957e9cd099e0383f01e06ca","sha1":"cd9d6f143b350822104d4cfe912432dc4448a11b","sha256":"c0f73415ce458a94c277feecc94ee093b600c129182c2b5b8b08e51064d49c77","sha512":"23136b9ad1cd1e791fd2e6f52f1e68b35693100191160062a5fb34d5adcc96900e1d252e9f4a8e19599f18f952792f937b5a30119989b944a759b9ae2902f8fd","ssdeep":"96:CeuOyJS4prbhz9ZczLN8KM/OIL/H/dd7pfqXZdSDHxRG:hBchz9Cz5A//H/tzHO","tlshash":"48a14231a12bcc62a19308a461fc9e215d9a57b4c1cc8e54ddaccd1d89fc8f6a70744f","first_seen":"2026-08-06T00:34:21.296566Z","last_seen":"2026-08-16T07:43:56.023265Z","times_seen":6,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":4,"connect":8,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"widget.salesmartly.com/plugin/info?language=en-US\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909713\u0026_lt=\u0026_u=\u0026_xma_=","fqdn":"widget.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.23.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.727Z","timestamp":1786847909727,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"widget.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 25 Jun 2026 17:24:38 GMT","end":"Wed, 23 Sep 2026 18:24:36 GMT"},"fingerprint":{"sha1":"68:24:AA:01:FE:7C:74:44:2D:65:E9:35:7B:E9:90:1B:B6:1A:F5:FE","sha256":"36:B9:DE:DB:E9:14:9C:92:9B:DB:B9:F9:98:FB:47:A8:7B:41:C3:86:81:D4:1C:61:2F:BE:FB:FC:2E:54:74:D9"}}},"request":{"raw":"OPTIONS /plugin/info?language=en-US\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909713\u0026_lt=\u0026_u=\u0026_xma_= HTTP/1.1\r\nHost: widget.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: external-sign\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization,Origin,Cpl,Client-Type,X-Requested-With,Accept,External-Sign\r\naccess-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE, UPDATE\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-expose-headers: Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Cache-Control, Content-Language, Content-Type\r\nserver: cloudflare\r\nx-request-id: f54d64cc-556e-42ac-8927-2d0b44346a68\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a2bd102bd812a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":730,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":1,"send":0,"wait":184,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f1.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.039Z","timestamp":1786847909039,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f1.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-10af8\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7M9geqeW04dFMeaQlAHv3wvyGgvU6LCgpZzUVEoJQmsjs25VNylAxZBk7oTsejv4sfPXw5ytdlGqdHc1nK%2BKqD7Dfz%2BXfkiWRYLyYnCqGgQ6xuCTfL6bTVO1l2i9cNb2pRvZ1d%2FlG5b0L1aGDhxYwwyeIPRbUVoWGw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277ee18deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 68344\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":68344,"size_decoded":69166,"mime_type":"image/png","magic":"PNG image data, 218 x 104, 8-bit/color RGB, non-interlaced","md5":"5f53a9c6b503c68211250213450e50ff","sha1":"171475b87dc4413bc263090278c98644fe79000b","sha256":"6618aaca311be9e830fbba76b6f6923b7f4c0f4c6ec51ff5b5442b0fc69cb74f","sha512":"10998784ceb1f2d436710a000ab03b7a47eb08b75595c5f18033947a827502122f1cd5465dd3065b73402104415f99da3deb9edbb4002889c8b9a5268b3dd71b","ssdeep":"768:rf94CCAkohkLVuBtYIZyACgZanbK3h/TuL4kPvPDGOZ+:nkDLVuBWUyBgabKtPkP69","tlshash":"31638602bf05e806e4582e758d76cbe96320fc485f25934739dabe2fbdae2d35d12244","first_seen":"2026-06-05T02:03:32.200962Z","last_seen":"2026-08-16T07:43:56.108075Z","times_seen":7,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f7.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.049Z","timestamp":1786847909049,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f7.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-1099e\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=musKkZ0qWW6EiZJk1CmQP7kaU%2BYJzEpIbriqxXszcA4jdeMUfZ3JPB%2FqUvFOZ3Qdbz9i6JRz6zAbxaBlbe97zUf%2FbfYa%2Ftwhbq3OqZbZeNnsy8Lx0sqBxU2MOghwNt3Hj2eRbzNJKncL5ke1uuQb%2BQbtQwDjqEMNng%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10278ee78deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 67998\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":67998,"size_decoded":68824,"mime_type":"image/png","magic":"PNG image data, 219 x 103, 8-bit/color RGB, non-interlaced","md5":"1cf93a4b7a5e49a819e24a0146b9f0b5","sha1":"7724e9050ff7e95f979007b7f6b911053a8f1614","sha256":"b6e319051742980ca8141c37a0c6c5abf0f7bf1680e97a72fa6a6300f87544e2","sha512":"f40f806af3dc9e8cb66c26a2322fdbd0dc4771bca08374b86831dacd3b9ff0c790b8803b699499efd60dc7cdff2b8057cf990f6afc41a417831eff5dac2556b1","ssdeep":"384:lDb7S/SK5vYHuqlsMKO6tyBlm0KfboaKtkeSv:lDb7A/5vYHucsMKOeyXrsoaKtkeSv","tlshash":"8d63a812bf45d813d5982e358a65c7d96331fc48af26834735dabf2faeaa2c25c12344","first_seen":"2026-06-05T02:03:32.203084Z","last_seen":"2026-08-16T07:43:56.027207Z","times_seen":7,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/css/ssc-iconfont-Cok29e2F.css","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.388Z","timestamp":1786847909388,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/css/ssc-iconfont-Cok29e2F.css HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css\r\nserver: AliyunOSS\r\ndate: Tue, 11 Aug 2026 09:00:08 GMT\r\nx-oss-server-time: 4\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A7AE498C9BFCE34392850C3\r\nlast-modified: Tue, 11 Aug 2026 08:59:38 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 15621541519379884351\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: VMTZyHw38prZOvfAtQLupw==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 0ca3a24436a7d86916b35130b21285a8.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: 2X42X-aBo2EpIZQLUXJBnzXFVqLYoM9P6v0uNYgsf23REkACof-GNg==\r\nage: 409101\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":145893,"size_decoded":66059,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"54c4d9c87c37f29ad93af7c0b502eea7","sha1":"87f904b71c9afcf9ed19c7376d00b747acdde5e2","sha256":"72e216cd0db7e2cf0dae0c882196d7762f13797a6c17620e2ae48980cc1cc498","sha512":"9b3cbb51565f3cd394c7760d81b9a5b8159f25c7d65383476c14294d561b383646b6807f4790d854453755bb2145129a2633219a81b1b68b3bf74ee37da56c82","ssdeep":"1536:JunTDOzLoiyVimLONTaeMxv0UqGgzlfzLSqFpFWGFeFjF4FFcpWtE+uV+F8oe5Ix:JFoXVdU6xcnnz9u+3","tlshash":"2be3087cea5025ddfd39ce5b231072289c3630effef54c48aaa6324a5be548cc590979","first_seen":"2026-05-29T23:23:06.269655Z","last_seen":"2026-08-22T16:50:46.360611Z","times_seen":359,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.salesmartly.com/chat/msg-user/create-user?plugin_sign=b40be6c6e5f2dc8564d608b144a12772\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910226\u0026_lt=\u0026_u=\u0026_xma_=728147","fqdn":"api.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:30.230Z","timestamp":1786847910230,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 21 Jul 2026 12:16:06 GMT","end":"Mon, 19 Oct 2026 13:16:04 GMT"},"fingerprint":{"sha1":"1B:33:CD:24:37:4F:CE:80:C5:C2:0C:BB:6F:12:74:63:10:84:B6:03","sha256":"E8:10:3F:17:1D:16:1F:70:2B:73:15:DB:1D:5A:64:0F:66:B3:21:D5:F5:60:F2:71:3F:C0:C0:F1:D3:25:33:4D"}}},"request":{"raw":"POST /chat/msg-user/create-user?plugin_sign=b40be6c6e5f2dc8564d608b144a12772\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910226\u0026_lt=\u0026_u=\u0026_xma_=728147 HTTP/1.1\r\nHost: api.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 372\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":372,"data":"source_url=https%3A%2F%2Fki1wrevfps6s.cityabovetheclouwst.us.cc%2F%23%2F\u0026language=en-US\u0026ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026user_id=c66fbc1b4b9036506606d4a888731a07\u0026data=eyJwaG9uZSI6IiIsImVtYWlsIjoiIiwiZGVzY3JpcHRpb24iOiIifQ%3D%3D\u0026is_sandbox=0\u0026before_source_url=\u0026label_names=\u0026custom_fields_ext="}},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:30 GMT\r\ncontent-type: application/json; charset=UTF-8\r\ncf-ray: a2bd102f1f51712b-OSL\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nserver: cloudflare\r\nvary: accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cpl, Agent-Cpl, Send-Cpl, Client-Type, Share-Access-Token, External-Token\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\nx-request-id: 59f0401a-e74a-4894-9a86-bb8fae892287\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":157,"size_decoded":823,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"7bbed8b08020acaddafe41a7166de07f","sha1":"d49ee4a57ad39920285f714ffecb79b84a206828","sha256":"d404f5e629133da0438ede7e229f7435495080fa8a2a9ab7becd9a24cafe18db","sha512":"e50661a7024d088a1f8f3f3958c5a2aa7f8c2ada07a7e2308ac52a9e1af9eac2fc3f91eb032eb9a4bfcb0cb3129c201e07f542fc280e7cb74522b29b6221ccf8","ssdeep":"","tlshash":"3fc08c277a5aa2e10697600ec41a204632ca05308912966ac8b8032c07ad3a0b2c18a2","first_seen":"2026-08-16T02:39:07.88097Z","last_seen":"2026-08-16T02:39:07.88097Z","times_seen":1,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":0,"dns":13,"connect":11,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msg.salesmartly.com/chat/chat-msg/recent-msg-list-v2?login_token=bdd1f3f0373269f478ae942b84410429\u0026limit=20\u0026sender_type=0\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026direction_type=0\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147","fqdn":"msg.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:30.553Z","timestamp":1786847910553,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msg.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 04:24:42 GMT","end":"Thu, 15 Oct 2026 05:24:40 GMT"},"fingerprint":{"sha1":"9E:33:85:67:70:1B:4F:B8:D1:EB:68:05:5F:92:57:7D:A2:27:69:7F","sha256":"EE:2F:33:B2:9D:C2:BA:37:C5:7A:B8:FA:32:C5:6E:B9:4A:8F:AC:F2:D6:7F:41:1F:95:C2:0F:C1:C8:63:5F:FD"}}},"request":{"raw":"GET /chat/chat-msg/recent-msg-list-v2?login_token=bdd1f3f0373269f478ae942b84410429\u0026limit=20\u0026sender_type=0\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026direction_type=0\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147 HTTP/1.1\r\nHost: msg.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nexternal-sign: 33c8d6b7bf375b5a89c4bd157309fd5c\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:30 GMT\r\ncontent-type: application/json\r\ncf-ray: a2bd10313cdc3181-OSL\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nserver: cloudflare\r\nvary: accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT, Keep-Alive, User-Agent, Cache-Control, Content-Type, Authorization, Origin, Cpl, Client-Type, X-Requested-With, Accept, External-Sign\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\nx-request-id: 45655b47-d97a-4b56-aedd-e5a1ddad3f8f\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49,"size_decoded":791,"mime_type":"application/json","magic":"JSON text data","md5":"78d539ac5b6a06a8bd02b3ace8debb63","sha1":"8e22651d8d1e678777cfebdb96983cf7df6e751a","sha256":"d817b79090a73b71e09ad6e2daa2c137408a7cfb7916aef50da18a1b1b0229f0","sha512":"e821cc4e11e272ac7ff31855b135a17839c3032c8d1e2a89683b7e937ac1443f8c7732821bf10fe3f120b05c9c5325e74f6b7616a478e5ff9c98ea2519e92a96","ssdeep":"","tlshash":"5390021218281c560b06a48a74091b0591d4114049141621cd8c5158870945c6582521","first_seen":"2023-05-07T20:28:16Z","last_seen":"2026-08-22T16:50:46.411145Z","times_seen":467,"resource_available":false,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msg.salesmartly.com/chat/chat-msg/centrifugo-token?login_token=bdd1f3f0373269f478ae942b84410429\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147","fqdn":"msg.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:30.557Z","timestamp":1786847910557,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msg.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 04:24:42 GMT","end":"Thu, 15 Oct 2026 05:24:40 GMT"},"fingerprint":{"sha1":"9E:33:85:67:70:1B:4F:B8:D1:EB:68:05:5F:92:57:7D:A2:27:69:7F","sha256":"EE:2F:33:B2:9D:C2:BA:37:C5:7A:B8:FA:32:C5:6E:B9:4A:8F:AC:F2:D6:7F:41:1F:95:C2:0F:C1:C8:63:5F:FD"}}},"request":{"raw":"GET /chat/chat-msg/centrifugo-token?login_token=bdd1f3f0373269f478ae942b84410429\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147 HTTP/1.1\r\nHost: msg.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nexternal-sign: 4894d6e9da34a1b522678358cc886c1b\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:31 GMT\r\ncontent-type: application/json\r\ncf-ray: a2bd10312cd53181-OSL\r\ncf-cache-status: DYNAMIC\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nserver: cloudflare\r\nvary: accept-encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT, Keep-Alive, User-Agent, Cache-Control, Content-Type, Authorization, Origin, Cpl, Client-Type, X-Requested-With, Accept, External-Sign\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\nx-request-id: 07f00c88-4372-46dd-8c3c-788f7d4aac12\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":478,"size_decoded":1076,"mime_type":"application/json","magic":"JSON text data","md5":"207706f7d1770a7f5bf3366f8ee544e9","sha1":"c79606daf17fe2ac96c09d6d04daefb2ee9d256a","sha256":"ee19eac9761d35ca600c2b09359af89e2dc1aff4808beeef72856471257d0208","sha512":"c64e618e2bfb376c3d022532841ed413ee65dca15904cf121f8bb3ec4d49d6710c2e2e0edcba83c057fe613ebd49f7532018dcac5259c0d52c1ffbefdb44c319","ssdeep":"","tlshash":"14f0dc8b463cdac51d89fa4096e5189942ce0df18f160635d7ba43e0cf622b2f3a3306","first_seen":"2026-08-16T02:39:07.886151Z","last_seen":"2026-08-16T02:39:07.886151Z","times_seen":1,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"srz.salesmartly.com/client/station/log?plugin_sign=f00ea091925074cff4cb89fb248088e3\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847911650\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147","fqdn":"srz.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:31.654Z","timestamp":1786847911654,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"srz.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 12 Jul 2026 16:59:55 GMT","end":"Sat, 10 Oct 2026 17:59:53 GMT"},"fingerprint":{"sha1":"27:93:BA:DA:50:AB:57:59:CE:78:C4:85:11:3D:A5:0C:CF:AE:87:BB","sha256":"69:85:C7:7F:1F:CA:99:12:24:04:AC:53:DA:7E:74:F0:7A:AB:18:6C:8B:DD:13:2C:B8:A6:B4:17:C2:0C:E6:AB"}}},"request":{"raw":"POST /client/station/log?plugin_sign=f00ea091925074cff4cb89fb248088e3\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847911650\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147 HTTP/1.1\r\nHost: srz.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 531\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:31 GMT\r\ncontent-type: application/json; charset=UTF-8\r\npriority: u=3,i=?0\r\nset-cookie: ss_uid=d87ca052c3f44bad08489809a51112fc; expires=Mon, 16-Aug-2027 02:38:31 GMT; Max-Age=31535999; path=/; domain=salesmartly.com; HttpOnly; SameSite=None; Secure\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cpl, Agent-Cpl, Send-Cpl, Client-Type\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a2bd10383e660b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"ss_uid","value":"d87ca052c3f44bad08489809a51112fc","quoted":false,"path":"/","domain":"salesmartly.com","expires":"2027-08-16T02:38:31Z","raw_expires":"Mon, 16-Aug-2027 02:38:31 GMT","max_age":31535999,"secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"ss_uid=d87ca052c3f44bad08489809a51112fc; expires=Mon, 16-Aug-2027 02:38:31 GMT; Max-Age=31535999; path=/; domain=salesmartly.com; HttpOnly; SameSite=None; Secure"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87,"size_decoded":838,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"4147f486e3b8f7a44964580944a8e818","sha1":"83cbb00f2d0d19d5c7ea75bc9596da8e491ede11","sha256":"c2088b17105e07f7d831bc27594c876650b80cd06dbe00c31b2434cd6de003e7","sha512":"bb65367a0656a490d777ad05c55d5be99b5ea92e9d29806a1bed083c1a4d0118c512d0918dd9e03a3b31a4178c44aa92a8853c6f5e789c6181e74059048bef09","ssdeep":"","tlshash":"21b02433147c035f0f0cf00d44043315c05501400d70134ccc5dc114c31c05c3101cf0","first_seen":"2026-08-16T02:39:07.889653Z","last_seen":"2026-08-16T02:39:07.889653Z","times_seen":1,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":0,"dns":27,"connect":31,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/tabbar/home-active.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.694Z","timestamp":1786847908694,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/tabbar/home-active.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-c7c\"\r\nexpires: Mon, 14 Sep 2026 16:27:21 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36667\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hEZ6olUoc8Df4JYKDQHLEEAZXNscnkVXMbv%2BzJNRDdr6mEdk%2BkhYU1zy3%2B0pms%2FHiXHCVhOrBD6vs8KTMjwgW4gdDcwypS4qJKYWhzo2LkZBKjFJ%2BHPiftjWDBZLXYCgHWTy96AnXCYOa9nNaKG2ivD%2BVWKfSotLcw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a2bd10255ecc8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3196\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3196,"size_decoded":4021,"mime_type":"image/png","magic":"PNG image data, 213 x 200, 8-bit/color RGBA, non-interlaced","md5":"3396c9643fe41b1aff86628323fb6fc4","sha1":"69b46b80712ac87276a8f0ca4f5f4ce99920799d","sha256":"31a36ea9ac9855a223d24a730dde96e22eddc5e1753faa16215288ccb5dca4c2","sha512":"81d4f04a9b8347c0db5bee51c3d790a5210631fc1f1cae28af039d1a6afe68767800a6094e632e20523288a0174ca873e1520bd31e7cbd4f2a30f8e43d9ac5b5","ssdeep":"","tlshash":"37614b500677fac01f897ee544e0a7a159253ac3270dd19c3db45c7b72a782d515da83","first_seen":"2025-08-11T17:15:18.595053Z","last_seen":"2026-08-16T07:43:56.018027Z","times_seen":81,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/pictures_t.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.034Z","timestamp":1786847909034,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/pictures_t.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-984e\"\r\nexpires: Mon, 14 Sep 2026 16:27:25 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36663\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VwxM4Mefkr7DJCVfCxT3uJnbCBOjfVUZqd8RkU9H3U87MkCQgXg3N645UelDyBzYyGbmA77QJgIQicy7Qf8UzEgqqYC6TcT8We4WgbPWb%2Fwg1bRb6rLPnp9A3fe%2Bk%2BdBrFNxV151WjRJlpry0hUuS6HeZWcmfv%2BU8Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10276edc8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 38990\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":38990,"size_decoded":39813,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 564x352, components 3","md5":"24006d4da954ed02b0189b1b74c3cd4f","sha1":"ebba860be00103b1eb42f65a6c5606a186c55783","sha256":"bc736c5c328ca94627c1735a13a2d7e11b6902f206c9aa2abf181cf69fd398f0","sha512":"c5c34396c15996354af32d8df293c4da3440a07134deb85e67045a898719b58c685d0c178bcd89ac1f0bfa9afe5554e772943433766b6a78c6a092e251798a30","ssdeep":"768:G1nDbaEclQ5vL46ZZHzacyJ2j/qqg/SSTSzTTe8kvOa3INxv8mYXUAUiMB:m3z0KHza/J9rSMOTeJma3av8mPAdMB","tlshash":"c603e12a2988cad5e516b47463d7a7c5f208fd0f3b55630a36e71c256b3e24877b0d30","first_seen":"2025-08-11T17:15:18.612911Z","last_seen":"2026-08-16T07:43:55.982651Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f8.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.051Z","timestamp":1786847909051,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f8.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-10ffd\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Izw6AKfIDZZR%2BuN7jHFwLifcCCPBlJ3GsRVTH25r2xnXvxuU5xJxu9B%2FL54GHJqBpz%2F1xoBgapEr4fVRwTBVnFvwRoqa15NJyc63hTbt4rE34wkB17qRiyIzRQ2Gh6elS%2FMFC2xuGlcnVl1rNSsbN2C%2FfSxdVgCWMw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10278ee88deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 69629\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69629,"size_decoded":70455,"mime_type":"image/png","magic":"PNG image data, 220 x 105, 8-bit/color RGB, non-interlaced","md5":"ac22017122bef43d600eb9dbe43362f9","sha1":"781b225ab3506f16ad3cf2af9f56025845608100","sha256":"9c839b848d08817f6ece0546cab69091c8faf7c6f8b54e9a873cdfdff1b4c1c0","sha512":"76af067f86d586b1a4d7ac7c364a193f633ab31c4b1827582add6bb3a61155a3f81e031f65db8121888ef3ce6b0c19350d737dfd1b2b0d8c496ce342590a86b1","ssdeep":"768:/soAhYVifBZ6Guoi/evl/zkdf1Uw9cs8Cvjyg886YO7mp:/s9SViZZPuoi/e9/wh1Qs8l9SO4","tlshash":"d2630c42bf45e802e4652e758c7ac7e86321fc489f25934734c6bf2fbdae6d25d12284","first_seen":"2026-06-05T02:03:32.229592Z","last_seen":"2026-08-16T07:43:56.009926Z","times_seen":7,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/css/plugin-DLtRvJ_8.css","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.389Z","timestamp":1786847909389,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/css/plugin-DLtRvJ_8.css HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css\r\nserver: AliyunOSS\r\ndate: Tue, 11 Aug 2026 09:00:08 GMT\r\nx-oss-server-time: 7\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A7AE498637FD23734526F3C\r\nlast-modified: Tue, 11 Aug 2026 08:59:38 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 7096420717608561594\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: am7+FzRFAPUKBlVjdt6Heg==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 0ca3a24436a7d86916b35130b21285a8.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: XyyTHvYAQUkYAhHhY326c2Gq_tLYk8jo8jZyja0OlgNkSSIhIHqkRw==\r\nage: 409101\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":316376,"size_decoded":94248,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"6a6efe17344500f50a06556376de877a","sha1":"8f239b24114106550a2758d3f5f339604cdc5fa5","sha256":"901d28eec871d10b977474cce7301ed7447c8e794813d4328d9609c87332b1eb","sha512":"371b82092a880363010b5c44b25b85565a4662b7773627de6129cda1a605ad8a1dd195c3f0e37c7ce1823ef898db16e44781374b9205d06f6928e0e8253b580e","ssdeep":"6144:JFoXHJxcnDD95VSSTDSv8MHz3xQRcOcOc5mjAibu8GWp:JiXon/95VSSTDSv8MHz3xQRcOcOc5mj9","tlshash":"8e64087cdb10313df937ca1266d0b69c6039a0e7feb30d4cba567229c2d60c95ab1a5d","first_seen":"2026-07-30T05:59:12.035349Z","last_seen":"2026-08-22T16:50:46.412672Z","times_seen":95,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"srz.salesmartly.com/client/station/log?plugin_sign=f8511f44c453ac67e51f36993205ed23\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909721\u0026_lt=\u0026_u=\u0026_xma_=","fqdn":"srz.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.733Z","timestamp":1786847909733,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"srz.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 12 Jul 2026 16:59:55 GMT","end":"Sat, 10 Oct 2026 17:59:53 GMT"},"fingerprint":{"sha1":"27:93:BA:DA:50:AB:57:59:CE:78:C4:85:11:3D:A5:0C:CF:AE:87:BB","sha256":"69:85:C7:7F:1F:CA:99:12:24:04:AC:53:DA:7E:74:F0:7A:AB:18:6C:8B:DD:13:2C:B8:A6:B4:17:C2:0C:E6:AB"}}},"request":{"raw":"POST /client/station/log?plugin_sign=f8511f44c453ac67e51f36993205ed23\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847909721\u0026_lt=\u0026_u=\u0026_xma_= HTTP/1.1\r\nHost: srz.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 421\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:33 GMT\r\ncontent-type: application/json; charset=UTF-8\r\npriority: u=3,i=?0\r\nset-cookie: ss_uid=eb9819effa2276c89e74afb625e8e12d; expires=Mon, 16-Aug-2027 02:38:33 GMT; Max-Age=31535999; path=/; domain=salesmartly.com; HttpOnly; SameSite=None; Secure\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cpl, Agent-Cpl, Send-Cpl, Client-Type\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 86400\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a2bd1040bff60b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"ss_uid","value":"eb9819effa2276c89e74afb625e8e12d","quoted":false,"path":"/","domain":"salesmartly.com","expires":"2027-08-16T02:38:33Z","raw_expires":"Mon, 16-Aug-2027 02:38:33 GMT","max_age":31535999,"secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"ss_uid=eb9819effa2276c89e74afb625e8e12d; expires=Mon, 16-Aug-2027 02:38:33 GMT; Max-Age=31535999; path=/; domain=salesmartly.com; HttpOnly; SameSite=None; Secure"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":87,"size_decoded":839,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"a075c0fce653dc8f26d288e507c756bf","sha1":"a93e6b112006081227d9c566c224ee70d82dfe17","sha256":"60fa1e52b2cd7dd0bc0718cf9660477c09849fd3fa993f899d8369b20522b954","sha512":"ec6c5ec08564c7a8b1830e15dbb13ee626ff35d026ffb3532d4238662dd6229de6fc03fe3026916caa2220121973181b1be556717e731151384e834e65971ac6","ssdeep":"","tlshash":"22b01225181403060d5668df10053b51a07901044f30575485bc07104309c9e6142473","first_seen":"2026-08-16T02:39:07.900803Z","last_seen":"2026-08-16T02:39:07.900803Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3579,"timings":{"blocked":-1,"dns":2,"connect":2,"send":0,"wait":236,"receive":0,"ssl":3337},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/pages-home-index.b5f64f36.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.663Z","timestamp":1786847908663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/js/pages-home-index.b5f64f36.js HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a617cb0-46ce\"\r\nexpires: Sun, 16 Aug 2026 04:27:21 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 36667\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E7xbhpmU1KCe7fAkBt0OAIyg9m3HE%2FEDtoQ7MU47RyYwIwXEN%2FFdJ7yO1bplu2NkmkjFyT3k8oGhA1avLEw%2B7cn%2BoMDi2drOIo3eR5tok5FFwszFIjjSIlY6sJ53NhW2JMsx3WCCFennsTEw%2BOHy3%2B0XNotsXa8hwg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2bd10251ec48deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18126,"size_decoded":5720,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (17864), with no line terminators","md5":"d13d417bdbe69e78a74c2a6f5ff8279c","sha1":"f6893d885f15f9c65cb0c374b067965777e1cf7a","sha256":"b9ed872418540f027c928d7f6f7fd198e9fddbff615ef70669388b2155915533","sha512":"ae392ccd528816ca80f645c8ee745e5c64af79d8bab5b43d7f435db934d60da9cb5a27c9ecab4e8b42e9f11faaaf856822ac9ef3830b48fb93efc3c3c3cc2ce9","ssdeep":"192:ItXBYyh/cDlqJRHen/kbL9h92A7fi1E5c7rAJrlFy2EZuzwW3TScbcLHtn:ItXBYyhfven/kFhz+fAJrlFy2iuzMQcF","tlshash":"5e827615b047b02e482fe421307f1a1490706f75d238e4eaeb76fd61cae8a9e3635b5d","first_seen":"2026-08-06T00:34:21.323459Z","last_seen":"2026-08-16T07:43:56.062947Z","times_seen":6,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/install.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.300Z","timestamp":1786847909300,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/install.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Sat, 15 Aug 2026 14:34:42 GMT\r\nx-oss-server-time: 2\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A8079020A7E1F3038B17C73\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT\r\naccess-control-expose-headers: x-oss-request-id, ETag\r\naccess-control-max-age: 600\r\nlast-modified: Tue, 11 Aug 2026 09:34:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 7237316794534657841\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=600\r\ncontent-md5: PAbo4KIkQnwHT/tsfeEE9A==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3fef473b9069c3a6b17fb47d4e1f2460.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: E60jhDKp9j0kAWy64cdDfANkkRPAIn5R5cO3TTShphA6Jz20Zjf_xg==\r\nage: 43427\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":10994,"size_decoded":5103,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10993)","md5":"3c06e8e0a224427c074ffb6c7de104f4","sha1":"11ff7a76084105b3497154af1cd7d5318386c0d2","sha256":"4ce82534967e063f78b2d8a7cdeb1d0f85316906feac29360d5f8d212c474fe3","sha512":"65f7e955ec2b9e01a1d18451624e29857615814070dcf61f2fae5f6b04916a6f2ec53287a2169600a60ceb4cf47b3f430f0abbcfb8db793f972118c3db48ce02","ssdeep":"192:cdoUYzvezFRvndgQCI2p3wf7LgaET/IUKe9uomy0dDrYntCKw9Lb26y2DdMiOAju:LUYzvezF5dtrLgjT/YdyykcB2HqhmnZp","tlshash":"ce32e8593427697992b80cc46079a311f6fd26633006d4a0f3bcceb9b555f8382b9eb9","first_seen":"2026-08-12T03:17:36.481104Z","last_seen":"2026-08-17T02:16:17.386039Z","times_seen":11,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":9,"send":0,"wait":32,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mix-ads.oss-accelerate.aliyuncs.com/prod/project/g1onvvl/d4w_v2/integration/plugin/image/20260529/1780043864452/%E4%B8%8B%E8%BD%BD.png","fqdn":"mix-ads.oss-accelerate.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.254.187.140","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:30.226Z","timestamp":1786847910226,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.oss-eu-central-1.aliyuncs.com","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 21 Jan 2026 05:48:22 GMT","end":"Sun, 07 Feb 2027 03:11:39 GMT"},"fingerprint":{"sha1":"64:86:8B:A7:E4:DC:0E:74:32:46:53:69:3C:B8:E4:89:DD:F6:BD:55","sha256":"B8:C1:A5:52:E0:02:69:05:3E:47:AF:74:43:E0:AC:57:AB:A5:93:BF:4E:FF:3B:47:70:FE:C7:D9:C7:08:29:93"}}},"request":{"raw":"GET /prod/project/g1onvvl/d4w_v2/integration/plugin/image/20260529/1780043864452/%E4%B8%8B%E8%BD%BD.png HTTP/1.1\r\nHost: mix-ads.oss-accelerate.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sun, 16 Aug 2026 02:38:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 487\r\nConnection: keep-alive\r\nx-oss-request-id: 6A8122A65943075ACAB0D7ED\r\nVary: Origin\r\nAccept-Ranges: bytes\r\nETag: \"FB204F3F756824DB07681B4B10ADA820\"\r\nLast-Modified: Fri, 29 May 2026 08:37:45 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 10903081455907546250\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000110\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: +yBPP3VoJNsHaBtLEK2oIA==\r\nx-oss-server-time: 2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":487,"size_decoded":1049,"mime_type":"image/png","magic":"PNG image data, 28 x 28, 8-bit colormap, non-interlaced","md5":"fb204f3f756824db07681b4b10ada820","sha1":"df5bb7f4dd54d54725e1d42893ac1c7d9bd165ef","sha256":"3fc596802454163807d62ed9ee331a401b33f33307f98c90af4040eb898d03ca","sha512":"1f5ba1015d52b00564b5adb7740e5e8ccbd578582896ebd6ad475e32e282c1279b885b5aa3c30faae5877bf2cfc695f6e98e10eede0fe43683bafe5bb19a2685","ssdeep":"","tlshash":"00f005af7703682dcc54e5dda4f122601416316729f504650525c8ad0553001f1b30db","first_seen":"2026-06-05T02:03:32.239199Z","last_seen":"2026-08-16T07:43:55.998597Z","times_seen":7,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":0,"dns":94,"connect":21,"send":0,"wait":180,"receive":0,"ssl":65},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/plugin-DZxWRE1E.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.556Z","timestamp":1786847909556,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/js/plugin-DZxWRE1E.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Sat, 15 Aug 2026 16:27:24 GMT\r\nx-oss-server-time: 2\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A80936CFE67F333382E899A\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT\r\naccess-control-expose-headers: x-oss-request-id, ETag\r\naccess-control-max-age: 600\r\nlast-modified: Tue, 11 Aug 2026 09:34:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 8984445031176306053\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: QY5JlaqGVrBXXB+O9ukRWw==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3fef473b9069c3a6b17fb47d4e1f2460.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: eT7dVSQjEKEnci3MdRjPgJd1T5_vHrQHu_h4-G4rICubd8uc7PsE2g==\r\nage: 36665\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":545470,"size_decoded":186939,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (65426), with no line terminators","md5":"418e4995aa8656b0575c1f8ef6e9115b","sha1":"f43d330c678fefd530bfe9b3bc116c67bc44ab57","sha256":"326e072e9d1a7a2eff4c44e4a8d7eb713ddf854bd3816ef073d1854002845a1c","sha512":"8624413e06f21ae318ddadcc3f9dd905b0e246446618c21c7cd4ec31d3b508d4f71ec47d49f47adef69aac26e6f115dcd4f29c6f45db358f02c01a0c53e86f74","ssdeep":"12288:Pesl7nAocT/FsH7kpZS43onCN7AzXZFBLbgOk0KNaQYaL1Cnr+WDMEwga7LRLP5x:mN1CrSVj5WqcTPY","tlshash":"d1c47c4df2a17876d3f2589090d20444626c0b7de01488e1f5bd9eb627b6da2e3b3b7d","first_seen":"2026-08-12T03:17:36.530709Z","last_seen":"2026-08-17T02:16:17.296733Z","times_seen":11,"resource_available":true,"data":null}},"time_used":33,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"client.salesmartly.com/js/marked/v14.1.2/marked.min.js","fqdn":"client.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"65.9.46.43","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.720Z","timestamp":1786847909720,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /js/marked/v14.1.2/marked.min.js HTTP/1.1\r\nHost: client.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\ndate: Thu, 13 Aug 2026 03:46:02 GMT\r\nx-amz-replication-status: REPLICA\r\nlast-modified: Fri, 20 Sep 2024 06:38:39 GMT\r\nserver: AmazonS3\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: JFBntxsrfZ64VoXBE8CHtNjr4.xFrBV4\r\ncontent-encoding: gzip\r\netag: W/\"4726c8d370952011c5137ee8e13eb6bb\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 6e6e790b457b3550da2b42352d46be18.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN52-P1\r\nx-amz-cf-id: _TuB1klK8JFBMeAGDCvs-PSCPSiNhGSGWe2bLHWi7ckeqmJRsuoCMA==\r\nage: 255148\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":36489,"size_decoded":11882,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (36340)","md5":"4726c8d370952011c5137ee8e13eb6bb","sha1":"96c7a41fdc5d4530bb46f1a629f86ecaf068de82","sha256":"eeaba2c06a990d4602b4142cce579f4cce16fba404e6cc82c5c2f7ccb1e7bd1f","sha512":"6d7c814f6fec623660d43ef29034ba789484e0314354f247bdb4407dd7d82abe88bacac2cfbc009929b7eafcfd1bcccca1bdb946faaef74bdfb77248ef5ca071","ssdeep":"768:aH13NvoICzvRDEeJX2QLGbdpB+xJhuLPbBc5jI0sJMF2/bOCbnEytnbBOmVzFoso:aHOXo5ECPbBc5MB2A/blnEMRoaM","tlshash":"67f2094832ae3a6987d439e66cf81060e27f8e68344c545cf664f5f37c2690a61ebf70","first_seen":"2024-09-13T03:55:13Z","last_seen":"2026-08-22T16:50:46.509624Z","times_seen":2887,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":0,"dns":13,"connect":11,"send":0,"wait":12,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/chunk-vendors.7a18bc5f.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.367Z","timestamp":1786847908367,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/js/chunk-vendors.7a18bc5f.js HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a617cb0-ca652\"\r\nexpires: Sun, 16 Aug 2026 04:27:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 36674\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WnDbQQBl3MdQBh8z9lLM0FsArVivQEwTf19qd6yfahTTAiXVNwtfTy6p6xlvzw0%2B7TS2BnOrSsjF6xxCtCWsE8nuGK6W1t46Hbl%2Bm385WPlabuFOQ5RDnS5trFxCdYOvRI0AvQfe%2FW2uLSPw%2FXHLPUHYN7%2F0MCMh6A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2bd10234e1e8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":829010,"size_decoded":292623,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65192), with no line terminators","md5":"68858237e334922290f783e204f35dce","sha1":"717dd13a47a18f30cf25199cd5735129063ba75f","sha256":"bb7ca93138e3d35e1597136c44ebe63d3968ee2333247ab349950c0d38abd859","sha512":"bdc360b025e65423832287c7dee817f93739f4e0278bbb13e575336e174a9c9bbea8bd39288f2b180ab7e51229e6f3fe968bd00cdb17457f3c41b5c22d143d90","ssdeep":"6144:OXtwTf3yPbMnnYKvENTlWbEvm/dO+Qh5V2viznm51/vxqnRuJwI6FK4Ikvy:OdwTfFnYkEtA3OIvizE0E0/Ikvy","tlshash":"e505f78df286b0b60ae730b5403f220bb2376959b40a84d4f675e4d4ad7894e6237f7d","first_seen":"2026-01-26T03:42:49.720514Z","last_seen":"2026-08-16T07:43:56.056835Z","times_seen":14,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/icon_box_4.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.038Z","timestamp":1786847909038,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/icon_box_4.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-d14\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QyUoBqghBnfDTUwiJjQzHokHvg6bQ3ollo04siDiMsyQy7L7W6ygyoMkkDgOtCpGWGs4i1C3PhvoGuylHogYCWQG3XkY9tfJYcpjZ53gxLQbIyCBJP0QVHk3wn9RjR9TjQSH%2FlJsWfu5YJGiXwuyLH2oZrIMFkNCTQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277ee08deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 3348\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3348,"size_decoded":4163,"mime_type":"image/png","magic":"PNG image data, 193 x 192, 8-bit/color RGBA, non-interlaced","md5":"e5618045243b8fbb796589911deeb9dc","sha1":"751680b6488cb9b804721fee0e2492d1af3b05ab","sha256":"a8fef6e8fcbddd163928d82c0e34691964176f185da2dbf303f55d4d04d7a553","sha512":"a045f53472f124741386d773530810e4a6b0f408e87162ecb3b4a0ddb9114d8d234329e914a072968d7f5b74bbb9b0249cdb74fc035612b2015ea464f1a2eba8","ssdeep":"","tlshash":"11615ce30c23c152e9940db61d303988b5fd1ca95015352629152da66e7fe447eeea0f","first_seen":"2024-11-19T07:54:21.363854Z","last_seen":"2026-08-21T05:10:27.229128Z","times_seen":641,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/js/project_728147_751822_1780039416.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"52.84.50.127","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.192Z","timestamp":1786847909192,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /js/project_728147_751822_1780039416.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Tue, 11 Aug 2026 11:33:05 GMT\r\nx-oss-server-time: 10\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A7B08719453943839B29D4D\r\nlast-modified: Fri, 29 May 2026 07:23:36 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 11202518501202037313\r\nx-oss-storage-class: Standard\r\ncontent-md5: kZ5CAwlMaOa6RRD57cW99Q==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 fd72662d19f1605cb71a8fd4814daf52.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P3\r\nx-amz-cf-id: onuvaithhqAA39LNmZPAORA752K5I5P2SLXGsPqpPQHo3TlXV5Cftw==\r\nage: 399924\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1187,"size_decoded":1180,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"919e4203094c68e6ba4510f9edc5bdf5","sha1":"987ef2a033198842389b68122480bff83d7d351b","sha256":"c9dcdde5c9e2e1fe2a2e57a7687ab2367e0bbbeeed65c250bf4a4e29237670d0","sha512":"384bfd28cc7ea71f8fa03c77a81903590bed8baca55af1b2f373be39256a826b3007da368e142dd941aee27a2f837300b0a51330cec95b1bc23b14c34338af4c","ssdeep":"","tlshash":"9121cc471c6364757ad5717b4b3f88ad399991432004cc10bc4dd4681f909d10a5eee4","first_seen":"2026-06-05T02:03:32.23619Z","last_seen":"2026-08-16T07:43:56.047664Z","times_seen":7,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":4,"connect":1,"send":0,"wait":3,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"plugin-code.salesmartly.com/chat/widget-v2/code/modern/js/chunk-common-BO1BJI-2.js","fqdn":"plugin-code.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"3.164.240.13","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.440Z","timestamp":1786847909440,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.salesmartly.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Wed, 05 Nov 2025 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:16:EC:FB:98:9D:64:FD:1E:C8:5C:02:6A:93:88:4B:65:15:09:07","sha256":"26:1B:3A:72:0D:8B:91:C8:40:3E:89:B3:CC:5C:13:07:99:A8:EB:AB:72:A0:AC:58:2B:0F:C1:C8:C7:85:2F:3A"}}},"request":{"raw":"GET /chat/widget-v2/code/modern/js/chunk-common-BO1BJI-2.js HTTP/1.1\r\nHost: plugin-code.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript\r\nserver: AliyunOSS\r\ndate: Sat, 15 Aug 2026 14:34:42 GMT\r\nx-oss-server-time: 5\r\ncontent-encoding: gzip\r\nx-oss-request-id: 6A8079020A7E1F3038DF7E73\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT\r\naccess-control-expose-headers: x-oss-request-id, ETag\r\naccess-control-max-age: 600\r\nlast-modified: Tue, 11 Aug 2026 09:34:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 3956808462139976565\r\nx-oss-storage-class: Standard\r\ncache-control: public, max-age=15552000\r\ncontent-md5: ofDTl1yVX934xLSevlaEBw==\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 3fef473b9069c3a6b17fb47d4e1f2460.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: iEsyRd9KUY6mYTWKHDuF9uNRmfOEs4l8ejezAF60eJqqUjk6w0A7Og==\r\nage: 43426\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":79629,"size_decoded":32459,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a1f0d3975c955fddf8c4b49ebe568407","sha1":"7b559dc893e3a59fe77d9553a8af7d6931f2e068","sha256":"85a50ac089309670d7b46e44d1ef17ab132599486ba995f6f12d07f72f4dd191","sha512":"e28c1ce7e3b1b762886f98bf8611a0b33a157c355a760d83602a75df917689c2013d51d4e52faa14445af13ec9bb6eed797f96db1ebd6a8bc8955c90289f1bdc","ssdeep":"1536:ffeY1Ph7WaDN38VCuXI3BDDAeP0/AKANwnntDi:fWYmahMqBDDAx/LANwntDi","tlshash":"507319e831a2b47113ea08e1507b0406f37d6845344ac4e9f5adaedf3e7641641abfbe","first_seen":"2026-05-14T12:23:11.157843Z","last_seen":"2026-08-22T16:50:46.311272Z","times_seen":394,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"111.231.169.247","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:31.414Z","timestamp":1786847911414,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 16 Aug 2026 02:38:32 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Sun, 16 Aug 2026 15:38:32 GMT\r\ncache-control: max-age=46800\r\nset-cookie: __uni__uid=rBEQUmqBIqhW/ferA3yyAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"__uni__uid","value":"rBEQUmqBIqhW/ferA3yyAg==","quoted":false,"path":"/","domain":"dcloud.net.cn","raw_expires":"Thu, 31-Dec-37 23:55:55 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__uni__uid=rBEQUmqBIqhW/ferA3yyAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":577,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-22T19:31:56.978969Z","times_seen":20337,"resource_available":false,"data":null}},"time_used":926,"timings":{"blocked":0,"dns":4,"connect":242,"send":0,"wait":231,"receive":0,"ssl":448},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/js/pages-account-bills~pages-account-deposit~pages-account-index~pages-account-message~pages-account-pa~0a2392ec.bf2d23c9.js","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.659Z","timestamp":1786847908659,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/js/pages-account-bills~pages-account-deposit~pages-account-index~pages-account-message~pages-account-pa~0a2392ec.bf2d23c9.js HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 23 Jul 2026 02:47:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a6180d4-d912\"\r\nexpires: Sun, 16 Aug 2026 04:27:22 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 36666\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3dbcSCK7NeFUNlk4F7K6h83KqYerOP87awzY6a8p80r8bseYN3wrEwz8zfAp%2BrBAZGC8SO0QHrhZS7R7MKsTB6Qkoa9hygfY2gAv9VeSNTJEVbmvPbZx5Cw2v%2BpzqbOUcLa9F9NiWZEBUkH2y7BxnQySmM1YedzwEA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a2bd10251ec28deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":55570,"size_decoded":33006,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55378), with no line terminators","md5":"10e8cb59c3dfd5e25d0aa53cdbd42a0b","sha1":"c3c15e43fc80b9bb9180755616b9ab42a19cb12c","sha256":"7e1e86096b9ccc7dbb4d96322fa6fd2191321adc6556d2f7ff5eb50d080cb659","sha512":"f71f9e4b49f254621b75e9b3377b3c07b824c41b8e95d3c1fd8c1802accc0d6d8e02750a04acc154ea66d93c46aadd90c6b83b8ddd8ecebe589d4ae36701b833","ssdeep":"1536:DFTsYId0FHoMqu7NdEAaM2Ol51hwJX2RcJZHYpN7xCIx/+eJF4cL3nnisGQaOmvM:DJsp0NVr7fnaMj51hwJX2RcJZHYpN7xT","tlshash":"0443eae6e10c1cd17f7bcc8f6244235f6549ff62d9968cc8f126564c8de23a021a9b7a","first_seen":"2026-02-27T17:58:08.23347Z","last_seen":"2026-08-16T07:43:56.06214Z","times_seen":5,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"msg.salesmartly.com/chat/chat-msg/recent-msg-list-v2?login_token=bdd1f3f0373269f478ae942b84410429\u0026limit=20\u0026sender_type=0\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026direction_type=0\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147","fqdn":"msg.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:30.556Z","timestamp":1786847910556,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msg.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 04:24:42 GMT","end":"Thu, 15 Oct 2026 05:24:40 GMT"},"fingerprint":{"sha1":"9E:33:85:67:70:1B:4F:B8:D1:EB:68:05:5F:92:57:7D:A2:27:69:7F","sha256":"EE:2F:33:B2:9D:C2:BA:37:C5:7A:B8:FA:32:C5:6E:B9:4A:8F:AC:F2:D6:7F:41:1F:95:C2:0F:C1:C8:63:5F:FD"}}},"request":{"raw":"OPTIONS /chat/chat-msg/recent-msg-list-v2?login_token=bdd1f3f0373269f478ae942b84410429\u0026limit=20\u0026sender_type=0\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026direction_type=0\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147 HTTP/1.1\r\nHost: msg.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: external-sign\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:30 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT, Keep-Alive, User-Agent, Cache-Control, Content-Type, Authorization, Origin, Cpl, Client-Type, X-Requested-With, Accept, External-Sign\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a2bd10310cc13181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":587,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":6,"connect":10,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msg.salesmartly.com/chat/chat-msg/centrifugo-token?login_token=bdd1f3f0373269f478ae942b84410429\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147","fqdn":"msg.salesmartly.com","domain":"salesmartly.com","tld":"com"},"ip":{"addr":"104.18.22.242","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:30.558Z","timestamp":1786847910558,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msg.salesmartly.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 04:24:42 GMT","end":"Thu, 15 Oct 2026 05:24:40 GMT"},"fingerprint":{"sha1":"9E:33:85:67:70:1B:4F:B8:D1:EB:68:05:5F:92:57:7D:A2:27:69:7F","sha256":"EE:2F:33:B2:9D:C2:BA:37:C5:7A:B8:FA:32:C5:6E:B9:4A:8F:AC:F2:D6:7F:41:1F:95:C2:0F:C1:C8:63:5F:FD"}}},"request":{"raw":"OPTIONS /chat/chat-msg/centrifugo-token?login_token=bdd1f3f0373269f478ae942b84410429\u0026chat_user_id=8e37fc43072041c43976e34ac18cec5d\u0026plugin_id=g1qlt2b\u0026over_time=\u0026env=chat\u0026_=1786847910549\u0026_lt=bdd1f3f0373269f478ae942b84410429\u0026_u=\u0026_xma_=728147 HTTP/1.1\r\nHost: msg.salesmartly.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: external-sign\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nOrigin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 16 Aug 2026 02:38:30 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: https://ki1wrevfps6s.cityabovetheclouwst.us.cc\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: DNT, Keep-Alive, User-Agent, Cache-Control, Content-Type, Authorization, Origin, Cpl, Client-Type, X-Requested-With, Accept, External-Sign\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-max-age: 86400\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: a2bd10310cc23181-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":587,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-22T23:26:51.564587Z","times_seen":18044534,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":15,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f3.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.042Z","timestamp":1786847909042,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f3.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-1190a\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aKrI5IaFyS3ANsjAZrfPB3dT%2B9XOpAmx3tcXDs5nQG3A4cHndkUw4y4jujVJjaOcsXGi2lRZ5WhZW8xT2Yk%2B%2FG0NAYj02qFhEm3jMM9%2BkEm3YadC9j%2BcLy4Yi2oDVIpnsS%2Byv1G3GeCAvhxq9NDtaNgiLyDQZyBKxQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277ee38deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 71946\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":71946,"size_decoded":72774,"mime_type":"image/png","magic":"PNG image data, 219 x 109, 8-bit/color RGB, non-interlaced","md5":"4604ab67695f02ea918ca6c2a4e83e01","sha1":"89b1bfb264d9b9d9bf37b3dbc5861869317cfd3c","sha256":"be6b40447e3101f156be90077e4fa950d36674ae9fc7c6cecd25662dd206e0d5","sha512":"5781fa70fed98479722b6d234be2cb7a69a81b2cd687a06145986d232bb119b45792d42815af02006edccdbc91e5071588f1401417e9b03e33fa0394bb8eedfd","ssdeep":"768:2175yv2HfzysyOxbBYMw2/NWEAx+owborcYKxPqEo+Joms:yJysnYRdF8Vxyuums","tlshash":"a3632c13bf44e817e8a81a358dbac7a96331fc48af16434734c56e7fadae7d24d11284","first_seen":"2026-06-05T02:03:32.202085Z","last_seen":"2026-08-16T07:43:56.050056Z","times_seen":7,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/partners/f4.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.043Z","timestamp":1786847909043,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/partners/f4.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-10ffd\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V1MDBuddSbkz39MZzv%2BRZVc%2FVZvUI%2FZqHOLZIfXx%2BQSecgqEZRhK%2FJUg9pZv%2BPkwIfHgnGfQ4Q%2B2NAGjRuMMthPDL23UpvAjnpASmfIm7nOdWesztpEHIfr6RWbqOl%2B0trFTU%2Fxx84yZTdOidZ8%2BYtkI5TMS2sln%2Bw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277ee48deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 69629\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":69629,"size_decoded":70467,"mime_type":"image/png","magic":"PNG image data, 220 x 105, 8-bit/color RGB, non-interlaced","md5":"2af8fed57cd2802d9aba1f5e5bec4c8a","sha1":"425b433b7a91897a7a6a2b9d9e7236157a3f8bc5","sha256":"5485f02f6791cbf54f29592ff5a83517a24a914e3505c05f6b60b716af536db8","sha512":"6ce7dcdd78bfb0358cb9a19d5d39c887521ac9b36823443fad2c8ee9c175271f859b737195572e1368c67f09cf6165bb34a04a9c94a1bdbbed875bda868b60f3","ssdeep":"1536:KMnX/2/Z06esoRhuGhx8FAlc8lOEwZpHKTsv3ipPp/d3W/UcwP:JnXexaPGGsuVGeP","tlshash":"3f631c427f41e806d5691ab68db9c7d82324fc885b22d38739c2ee6f6cee7d35d12240","first_seen":"2026-06-05T02:03:32.204758Z","last_seen":"2026-08-16T07:43:56.039635Z","times_seen":7,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/tabbar/start.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:28.697Z","timestamp":1786847908697,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/tabbar/start.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:28 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-531\"\r\nexpires: Mon, 14 Sep 2026 16:27:21 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36667\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HaYXBfyPQgca9pLpfwKYv3SdBVhrfsWZ9Ea1mYuRALjJmTJ2kCjfPj5bNanviR2LH3V51x%2FH5XF40kll1I4dmWhw6C57xdgJPMVFKYBS3Yx1FXYqX2QqK6o5sBtmPsuYqKEQ%2FLe7j7L70rOdbOqg2BXtWR4HEvlHIg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i\r\ncf-ray: a2bd10255ece8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 1329\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1329,"size_decoded":2146,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"2d982a82d3f591699fdaed7185f8aaee","sha1":"018bb32582150990b5be2b0922db49b8d8e772d7","sha256":"be88964d7a0b6e84539afe4b9d2d337231d5486d621d915b6062571720c4622a","sha512":"670c3ad2dbf15e3d900268e871e8ece5e4a4b3085db844c5947deb43cdee885f5d093186a3f53bfd81c89f7649c1723ede21fc91637269dcbee41894eb748940","ssdeep":"","tlshash":"2921c81bb3c88d2a3586b162a8230a7a48141721bf26170ddb124fd4c627509a4db4f7","first_seen":"2025-08-11T17:15:18.611047Z","last_seen":"2026-08-16T07:43:56.044604Z","times_seen":73,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ki1wrevfps6s.cityabovetheclouwst.us.cc/static/images/icon_box.png","fqdn":"ki1wrevfps6s.cityabovetheclouwst.us.cc","domain":"cityabovetheclouwst.us.cc","tld":"us.cc"},"ip":{"addr":"104.21.78.111","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ki1wrevfps6s.cityabovetheclouwst.us.cc/","date":"2026-08-16T02:38:29.035Z","timestamp":1786847909035,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cityabovetheclouwst.us.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 09 Aug 2026 08:27:41 GMT","end":"Sat, 07 Nov 2026 09:26:30 GMT"},"fingerprint":{"sha1":"08:EB:15:CB:CE:3A:D1:5E:AC:DD:5D:5A:C3:21:36:64:E6:DE:35:41","sha256":"7C:CB:48:C7:DE:E8:C4:F9:CD:29:93:D6:27:A4:22:3D:B1:3B:E2:3C:42:98:C1:B3:21:EC:42:64:8E:7E:8E:09"}}},"request":{"raw":"GET /static/images/icon_box.png HTTP/1.1\r\nHost: ki1wrevfps6s.cityabovetheclouwst.us.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ki1wrevfps6s.cityabovetheclouwst.us.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 16 Aug 2026 02:38:29 GMT\r\ncontent-type: image/png\r\nserver-timing: cfExtPri\r\nlast-modified: Thu, 23 Jul 2026 02:30:08 GMT\r\netag: \"6a617cb0-114e\"\r\nexpires: Mon, 14 Sep 2026 16:27:24 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nage: 36664\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R5NOTbiWNg25idZkShRPlxl6jVOStQl3mgiZytlDnhXmGduxNoNTsW44xw4iggn2q0NqbrM9jl8I65qQfdroxIPYZj8xkFb21rYJ5%2BvfZM8bBcw3SCn9dMRw8ujCVdA2sch8shzRVHflzHwdIXo%2BadQd0shPqSQG3A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a2bd10277edd8deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 4430\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4430,"size_decoded":5248,"mime_type":"image/png","magic":"PNG image data, 193 x 192, 8-bit/color RGBA, non-interlaced","md5":"6acc5ea63480977112e33d4e21c4cbef","sha1":"692bbadde81ff9b82b0343fa4c05dc82ad076cdd","sha256":"ea7e56e5af17e18a1e12e514e32a3ef40928d522aeb031f1388c2d9d7796f515","sha512":"2fc39f0266ca57bec9808ca8e074c3fe6e823422ad950d896e4b66df066ca5dc80ed991796bee82acd0388a206fc470404c4068a82776f6406872bb3e1878ea2","ssdeep":"96:17vXZylQIxi/7YSvkYjYBQi1E3z5Opfgqgz3q85dze:1LXolQIxizsYp9+fgqR8DC","tlshash":"2c919ebc27ed8f93c30cc2fa4a17a722c4a06437e20ba190c6fd9340ebb6166416538c","first_seen":"2024-08-19T16:11:10.099083Z","last_seen":"2026-08-21T05:10:27.167924Z","times_seen":650,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-16","alert":"Phishing Block","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-08-16","alert":"Sinkholed","trigger":"ki1wrevfps6s.cityabovetheclouwst.us.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}