{"report_id":"c93f483b-314c-417d-9d5a-6cae1abcd621","version":6,"status":"done","tags":["botpanel","malware"],"date":"2025-10-23T08:15:44Z","url":{"schema":"http","addr":"91.92.240.66/","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"http","addr":"91.92.240.66/","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"title":"91.92.240.66/"},"submit":{"url":{"schema":"http","addr":"91.92.240.66/","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":0,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-27T08:15:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null},{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]},"summary":[{"fqdn":"91.92.240.66","ip":{"addr":"91.92.240.66","port":3434,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":7,"request_count":19,"received_data":4721725,"sent_data":7412,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"http","addr":"91.92.240.66/","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9c8373d1654725ca6b33895cc9035a0f","sha1":"94e7eadd796c2d91b9a83c333b22e8d8287bda63","sha256":"802b469d15e90d9047cfe64e4d9c536dfb6b883c7b0f3c0ae64b0c370033ae21","sha512":"46d15509c2906334e09ab09a8e3caabacbbcb748cbc1f21612f027694c0e460d1d7987719a2828a9d0b998d9d4f1671299c3657046ef65057f387f9d130e5caa","ssdeep":"","tlshash":"0ec08c01ed10cdceb4f0e808e34f34a1a500b1203aa0a175868a0dc69c28435a788e8a","size":164,"data":"","first_seen":"2025-10-23T08:15:52.904471Z","last_seen":"2025-10-23T08:15:52.904471Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"70597646447438e8dc6d467a58c8b621","sha1":"5ef2d7ea812458650bc92eb9e54cfe2be154cb98","sha256":"14e964da24f4245105a12c0d591295ba8cd8732506898e9aa6e9e346936e39a3","sha512":"90ae7b8e2aa00105b103a9b5f9c6e7b9e45d4610080e7bc83c14e523f0abe39d6f4506e1c3690a79678f1cd59339b6fdb8a843fee686893b55aacb00b2b21da0","ssdeep":"96:ahrCpk3W95qoLTnkf4PTSPCkKlse1Yw95OhWkT3pFiYvVv:adCpkM5RbkgPTSPCk4syvOhDT7iYvVv","tlshash":"17b15298b6c7f030869664ba403f600bf3b6745614ced450e026d8e1ee78a8d6567f6d","size":5195,"data":"","first_seen":"2025-03-18T06:45:47.259891Z","last_seen":"2026-05-09T07:07:06.299309Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/9464f645-6eb2-49cc-9390-3d2ef32e124a","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"3e9b9668b70613ddd4152d2e13fad214","sha1":"0f2b0cd34b98fd2307631c527543a6bfe86ac23d","sha256":"86960fce5ce4935689f546d8b5b297c7b1632b719644c99aa4a24aee3d8ff678","sha512":"f2f6d7a75a6b258a208346abb74d6054682d8f74bd36dc2cc64159e675619d3fe673d04fb59eee3039f084f3dcefed61b80ea4a5b509aaff79d3c5d054999115","ssdeep":"49152:z+i6S/EHSLRLf6cZcuiO+PTi2Kh93s2UWR1aMqg7P7:GU7Glmp","tlshash":"8306c44c365bf314915a80d7e43b2c49e2aee589a00b44e06f3187f31ab5746fb6ee17","size":3667991,"data":"","first_seen":"2025-10-23T08:15:52.911704Z","last_seen":"2025-10-23T08:15:52.911704Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"91.92.240.66:3434/socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8mae","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":3434,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:22.923Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8mae HTTP/1.1\r\nHost: 91.92.240.66:3434\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://91.92.240.66\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With\r\nAccess-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE\r\nAccess-Control-Allow-Origin: http://91.92.240.66/\r\nContent-Type: application/octet-stream\r\nDate: Thu, 23 Oct 2025 08:15:22 GMT\r\nContent-Length: 85\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"69647fcbb74681345ac58e3d7f05abbc","sha1":"b2574d8936f89e12f620143ed87746aac0676f2a","sha256":"a642ecd7843647094ed6a45e168c31e0f99bef5454f7420071e01dbe23056f95","sha512":"280bdbaa9f6bdb4fcb0f4dcff3cdc768c8badcc1b9b87a334652bf4b5db262624c9f83e9d5b6df4c65b3b67d9c0cdf41ea10b0b285dfe8fc0c9aea5c71c1eebb","ssdeep":"","tlshash":"69a01204a55e7385ea203f4020f20a054918785d86c1044c3128048401c61106112327","first_seen":"2025-10-23T08:15:52.769341Z","last_seen":"2025-10-23T08:15:52.769341Z","times_seen":1,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"91.92.240.66/","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-23T08:15:18.495Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T22:07:09.704674Z","times_seen":17750852,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":63,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fonts/icons/style.css","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:18.909Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/icons/style.css HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:18 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 22 Oct 2025 21:19:48 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94a74-db0\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3504,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"cf10c1b8b9348fc2752bd628143e6769","sha1":"da766143af460e3863f789fc1db9b281766cb4bb","sha256":"002a20bb327c239893a00b908f0ed4cebb527a2957e61aa49528b71a6a450490","sha512":"a18ae99e905020f19401f6632a91a15c1505268a4199459de96f08010596dafefd48aa94bfb4a6e62497f5a0d4b0329032901bebbf6117bf9a7239e595de6e63","ssdeep":"","tlshash":"a07177f8a87d11405b60de91a3533a31af2c91b4ce936c8af2579c5c67eb6009186ffd","first_seen":"2023-04-13T12:48:38Z","last_seen":"2026-05-09T07:07:06.284537Z","times_seen":155,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":55,"dns":0,"connect":64,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fonts/icons/permissions/style.css","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:18.910Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/icons/permissions/style.css HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:18 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 22 Oct 2025 21:19:48 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94a74-569\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"e7a2f49096e4eec6fb152bd3bbd3a79d","sha1":"7edb77dfac88b03ae84579f7df14d7970dbf8e48","sha256":"192a731c7357c9cc21c2ed31feb497561738fbb7353e047d3eb30bf06075c7f5","sha512":"899bbe2a1d6e972ad2553cee2ec9395121a2802f070dac3232df6b21029c2e53809b4cea72f8ebc673f12b7f9e744e8e3ab72878b2c32a34f4e3a431381abb68","ssdeep":"","tlshash":"db2127e4ecbc18805351d4c432a73b64bf1c92169c4a6c5aa7a3780caff774191e238d","first_seen":"2023-04-13T12:48:38Z","last_seen":"2026-05-09T07:07:06.276529Z","times_seen":157,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":54,"dns":0,"connect":64,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"http","addr":"91.92.240.66/static/js/main.a42f9d51.js","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:19.377Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /static/js/main.a42f9d51.js HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:19 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Wed, 22 Oct 2025 21:24:02 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94b72-37f817\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3667991,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"a529457c30d61a019dd6742dd383b89f","sha1":"d63e1a97d8d540b58c6f90222d2880172ca49d85","sha256":"46c2d775b7ee9ce9ae005476e90ce1f0c71b099efb21c2e62e9a15cd0b04e004","sha512":"dcdc865ffbf46ba86b63611bec6b17af4e51cb93b1af574a7e37613b37973c8a0a6d3271881eeab93f4670703c30ae2aeb9478100c2b21a36e46f198ea587881","ssdeep":"6144:Xj/NQi6Sf58ihw9TXXpYCZqJ+ooJGvuLqn+OHrYq5XLRLfF4pHUI:z+i6SfXyNHiHciLRLfup0I","tlshash":"fe25714c2a4ef3009959c0e7e93b2c49926de146b40b08a06f3097f75ab5397f7edd26","first_seen":"2025-10-23T08:15:52.833617Z","last_seen":"2025-10-23T08:15:52.833617Z","times_seen":1,"resource_available":false,"data":null}},"time_used":289,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":74,"receive":215,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66:3434/socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8lyI","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":3434,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:20.340Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8lyI HTTP/1.1\r\nHost: 91.92.240.66:3434\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://91.92.240.66\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With\r\nAccess-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE\r\nAccess-Control-Allow-Origin: http://91.92.240.66/\r\nContent-Type: application/octet-stream\r\nDate: Thu, 23 Oct 2025 08:15:20 GMT\r\nContent-Length: 85\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"811f429ce64c428b711c5f74542f2281","sha1":"e5dbe0bc3a547c8df39953481a03eee52b0724da","sha256":"9367a5e4c447dfc726e3b888625775966d7e7baa102da1da2abfed87ac6c3af2","sha512":"ffc0d437762a4830fd3cf24b8236553ec137d86730d2cfd32f3e1999705fa04893197881a9786e28bdcb329c7f275038e2c7485c1e204c349c7b306c185413b9","ssdeep":"","tlshash":"4ea01204d55e7385fb203a4020f20a055828785d86c1048c3228088401c61106112327","first_seen":"2025-10-23T08:15:52.844198Z","last_seen":"2025-10-23T08:15:52.844198Z","times_seen":1,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":64,"dns":1,"connect":64,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-23T08:15:18.652Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:18 GMT\r\nContent-Type: text/html\r\nLast-Modified: Wed, 22 Oct 2025 21:24:02 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94b72-1e8d\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (7821), with no line terminators","md5":"83e98fc24dd71c194cd2867e85a0a1cc","sha1":"5b3badeba06f890bed2cad692d1905f90fd1fee1","sha256":"3ccfe658a3e38ebefbbb2eff6719d7b73ae12545db5e697c39be2b0b8d1e5984","sha512":"a2d9720f1e02e18da1513624ae88762b0370e88fe10ed7b95e43aa37afa71bff9c44b00b3576418e3d0d04cf39e6398d899c4a17356dc684a34ea8b09c9da911","ssdeep":"192:SUvA0g7gpDOJdCpkM5RbkgPTSPCk4syvOhDT7iYvVwRQp:ZPDOLCC4bDT1sDT7iYvVHp","tlshash":"abf1b798b582b0345263b0b6507fa00ef27a7406a48bd820e037d4e5eeb8e8d5573f7d","first_seen":"2025-10-23T08:15:52.851888Z","last_seen":"2025-10-23T08:15:52.851888Z","times_seen":1,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":57,"dns":0,"connect":61,"send":0,"wait":62,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fontawesome/css/all.min.css","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:18.906Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fontawesome/css/all.min.css HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:18 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 22 Oct 2025 21:19:48 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94a74-18d98\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":101784,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65317)","md5":"6cb5a85b30082e3d59d7e371e002ce8d","sha1":"0c639634f474b4601a7937f440096185f3a9d8d3","sha256":"01b035efb5dfa529c512f82962ed633328222da6f33c224244806d4798c67349","sha512":"c61e8efc2910a0f3960dd6130ea79174f0957754a9bc203d5d77149d94b616624da75728005cefb4237d0666a613ee1a1caf32c941d44827091e05e5a13c93d8","ssdeep":"1536:4fMCMPMCMjMCM4MCMwMCM3spL70pgbPMfjSFbTyMGu3prfZCC:070pgMGFvyMGu3pfZCC","tlshash":"23a3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-04-06T20:32:18Z","last_seen":"2026-08-06T15:51:00.4376Z","times_seen":5637,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":56,"dns":0,"connect":62,"send":0,"wait":64,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fonts/mulish/style.css","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:18.912Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/mulish/style.css HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:18 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 22 Oct 2025 21:19:48 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94a74-672\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1650,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"52a70196f93d6cbde026b45ed2be798a","sha1":"77f415c3dd48043669df473d94a9200f867fcab8","sha256":"e09bb0962eaf03380ebd592134c4cbccd9a9dbe0cad5d8c886c42e50c078e728","sha512":"6df289b62da4ff426698f1244e678d05634b59c01216d1f53951c0dbce659c21a3c1fb16a66e22bb0b5e75b95bbba9f726f7c48477f8bab1aaff32cfaa309f54","ssdeep":"","tlshash":"19317881140a2910f2672ccd27ce6e26d50ea143514062327bfebbd5afba93422a8f5d","first_seen":"2023-04-13T12:48:38Z","last_seen":"2026-05-09T07:07:06.291702Z","times_seen":154,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":52,"dns":0,"connect":62,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"http","addr":"91.92.240.66:3434/socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8pd7","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":3434,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:35.370Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8pd7 HTTP/1.1\r\nHost: 91.92.240.66:3434\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://91.92.240.66\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With\r\nAccess-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE\r\nAccess-Control-Allow-Origin: http://91.92.240.66/\r\nContent-Type: application/octet-stream\r\nDate: Thu, 23 Oct 2025 08:15:35 GMT\r\nContent-Length: 85\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"078f1515d0ae897f2f65b90d818cf2ee","sha1":"3d28cd6fa5ae32cd688be97dd91184903f04cd42","sha256":"abe4ad65475b17687163889783ab88124cb3a65ea55bfbdf578bdf713499aed3","sha512":"f946b0803ca75858241e3294da5c8a542b9e9a40f318f9001f2bcfe3e5f9db5fd66e86c0d9acfb767018b8431b109f3a3415273027651abeac02fb773f95dd17","ssdeep":"","tlshash":"0ea01204955fb385ea203f4020f60a258918785d86c1044c3128048401c6110611232b","first_seen":"2025-10-23T08:15:52.871384Z","last_seen":"2025-10-23T08:15:52.871384Z","times_seen":1,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":63,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fontawesome/css/fontawesome.min.css","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:18.904Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fontawesome/css/fontawesome.min.css HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:18 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 22 Oct 2025 21:19:48 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94a74-13b0b\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80651,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65317)","md5":"d318f674308800c356f650173502cf6d","sha1":"f2c5219fb9f58c2baee6dbd965741975cbc8ae71","sha256":"863ab50a39fc203ca8f614cef14c6cc700ee64bfeacd41426dce9ef8cbd98509","sha512":"46f431c1ffb7cc9b8dc25e1ed2c66341e5fb9146b7a3cd9b0c44e9815087d918b06126550dd149ecdff0a0d8a037f95dc8e3a82b0f39f388cce2995076df1b84","ssdeep":"1536:4fMCMPMCMjMCM4MCMwMCM3spL70pgbPMfjSFbTyMGuF:070pgMGFvyMGuF","tlshash":"ab73cbf5e44c15d97732c44beb58b37c61b6f738d9810da9f02f580d1ac26a822c6b7a","first_seen":"2023-04-07T14:45:52Z","last_seen":"2026-07-31T09:04:37.03398Z","times_seen":403,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:19.146Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2 HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/assets/fonts/mulish/style.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:19 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 11232\r\nLast-Modified: Wed, 22 Oct 2025 21:19:48 GMT\r\nConnection: keep-alive\r\nETag: \"68f94a74-2be0\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11232,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11232, version 1.0","md5":"f4429b00adf61350183e1037f446fd40","sha1":"a23ad1c7b309f8da507b96efad46313f72d3a351","sha256":"ad234f0985f2142bb1fa3a281ddf2511d320f84f73422df2b2384f115b4b9131","sha512":"4878a81633320634eab8d6493c130eec573834433693096b2acecaf0bcc9232c2a945a06a61b2e4522e1a5f789b84221098dfca7d6db071efe9586bd77c07bf3","ssdeep":"192:lIIvN2i4YfGz24CRxgELe5Wx6gN9bXf30Am9Ht1NOqQOn6ivI:lIIvN2i4rz2bjESvfPTmtXOdqvI","tlshash":"0532b0e8abda6657464636f7b49a0c7cc1d41b442f1f4a0a1886c733905f72a8248277","first_seen":"2023-04-09T18:33:33Z","last_seen":"2026-07-29T08:19:49.552612Z","times_seen":840,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fav/favicon-16x16.png","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:19.320Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fav/favicon-16x16.png HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:19 GMT\r\nContent-Type: text/html\r\nLast-Modified: Wed, 22 Oct 2025 21:24:02 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94b72-1e8d\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (7821), with no line terminators","md5":"83e98fc24dd71c194cd2867e85a0a1cc","sha1":"5b3badeba06f890bed2cad692d1905f90fd1fee1","sha256":"3ccfe658a3e38ebefbbb2eff6719d7b73ae12545db5e697c39be2b0b8d1e5984","sha512":"a2d9720f1e02e18da1513624ae88762b0370e88fe10ed7b95e43aa37afa71bff9c44b00b3576418e3d0d04cf39e6398d899c4a17356dc684a34ea8b09c9da911","ssdeep":"192:SUvA0g7gpDOJdCpkM5RbkgPTSPCk4syvOhDT7iYvVwRQp:ZPDOLCC4bDT1sDT7iYvVHp","tlshash":"abf1b798b582b0345263b0b6507fa00ef27a7406a48bd820e037d4e5eeb8e8d5573f7d","first_seen":"2025-10-23T08:15:52.851888Z","last_seen":"2025-10-23T08:15:52.851888Z","times_seen":1,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66:3434/socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8n8I","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":3434,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:25.210Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8n8I HTTP/1.1\r\nHost: 91.92.240.66:3434\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://91.92.240.66\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With\r\nAccess-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE\r\nAccess-Control-Allow-Origin: http://91.92.240.66/\r\nContent-Type: application/octet-stream\r\nDate: Thu, 23 Oct 2025 08:15:25 GMT\r\nContent-Length: 85\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"f1bfdc48c0799520fb1b700d3ce9d87f","sha1":"97a4ddda98e6a21573fcfc6d9bc7ecebfc268aad","sha256":"5ce902818d0b953f1212f6b6107b99aff8f66c2393041012a333733e333d2fdf","sha512":"d7292c8340b7ae301f445d0567c333c6bb1ce63d33d9f61a8b616a773f243840c754882d44a31aebe0eca25897584b932c460293f1a5d9d7eeabf07ca55f7b33","ssdeep":"","tlshash":"7ea01205955e7785ea203f4021f20a054918785dc6c1045c3128048401c61106112327","first_seen":"2025-10-23T08:15:52.885365Z","last_seen":"2025-10-23T08:15:52.885365Z","times_seen":1,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66:3434/socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8oNr","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":3434,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:30.296Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8oNr HTTP/1.1\r\nHost: 91.92.240.66:3434\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://91.92.240.66\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With\r\nAccess-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE\r\nAccess-Control-Allow-Origin: http://91.92.240.66/\r\nContent-Type: application/octet-stream\r\nDate: Thu, 23 Oct 2025 08:15:30 GMT\r\nContent-Length: 85\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"aa50d638149530059aea50ac079e2c28","sha1":"dcc3f3198f34885b33c9546da3028fea2d471a4e","sha256":"40f5de0c30acae746ad4635d34b3ab97b57737cbac3a839bfece657f3d347f93","sha512":"5bee36f7068d14bc9505d8c6ef409ed1efff65aa7cb0cdc0ed70ba706672ce6da1be271dd1dfbd40ae4d5e26af9cbd1250a0bf22f06128aa46a0af76bfa13c5b","ssdeep":"","tlshash":"e2a01204955e73c5ea203f4020f20b054918785d86c1048c3228049401c61106112327","first_seen":"2025-10-23T08:15:52.887926Z","last_seen":"2025-10-23T08:15:52.887926Z","times_seen":1,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":66,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/static/css/main.c5c6a741.css","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:19.157Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /static/css/main.c5c6a741.css HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:19 GMT\r\nContent-Type: text/css\r\nLast-Modified: Wed, 22 Oct 2025 21:24:02 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94b72-a3c08\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":670728,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (53209)","md5":"9ccc5ca3fa59d5f9e5a924cd6e1b831c","sha1":"50cc2675b9cacea1129995f7bbb52d590c9a9b74","sha256":"a2599d256497b92a450ca34fd862676589ea6dc5fe5a71101e9945154a85af9f","sha512":"8ca059e168f4171df10c9c1b568e56d4e5a2dc0f34f3a9ba18bd69efdb69ab1b498c51f2c411b94e7d60883b737421df78f0146f2694589dba6eeacd3c127730","ssdeep":"6144:D+c3ARRdzjJzsDNauoD+NEwJaZvoIqyuuHd/zrHoSxuDKVkIIbmP7FW:D+c0aO8","tlshash":"76e4d818ab41306fe5e7c73b65e0f964ad21ca02d67f8a7ff2e17b188b4564d01b3a05","first_seen":"2025-10-23T08:15:52.895863Z","last_seen":"2025-10-23T08:15:52.895863Z","times_seen":1,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fav/apple-touch-icon.png","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:19.319Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fav/apple-touch-icon.png HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:19 GMT\r\nContent-Type: text/html\r\nLast-Modified: Wed, 22 Oct 2025 21:24:02 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"68f94b72-1e8d\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (7821), with no line terminators","md5":"83e98fc24dd71c194cd2867e85a0a1cc","sha1":"5b3badeba06f890bed2cad692d1905f90fd1fee1","sha256":"3ccfe658a3e38ebefbbb2eff6719d7b73ae12545db5e697c39be2b0b8d1e5984","sha512":"a2d9720f1e02e18da1513624ae88762b0370e88fe10ed7b95e43aa37afa71bff9c44b00b3576418e3d0d04cf39e6398d899c4a17356dc684a34ea8b09c9da911","ssdeep":"192:SUvA0g7gpDOJdCpkM5RbkgPTSPCk4syvOhDT7iYvVwRQp:ZPDOLCC4bDT1sDT7iYvVHp","tlshash":"abf1b798b582b0345263b0b6507fa00ef27a7406a48bd820e037d4e5eeb8e8d5573f7d","first_seen":"2025-10-23T08:15:52.851888Z","last_seen":"2025-10-23T08:15:52.851888Z","times_seen":1,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"91.92.240.66/assets/fontawesome/webfonts/fa-solid-900.woff2","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":80,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:20.356Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/fontawesome/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: 91.92.240.66\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/assets/fontawesome/css/all.min.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.29.2\r\nDate: Thu, 23 Oct 2025 08:15:20 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 150472\r\nLast-Modified: Wed, 22 Oct 2025 21:19:48 GMT\r\nConnection: keep-alive\r\nETag: \"68f94a74-24bc8\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.29.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":150472,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 150472, version 770.256","md5":"3e50e269ee627bb2279f91d18c085167","sha1":"a7fca574d24e9ffa5ee0e0589ffe17277ae4ec27","sha256":"d27bc752105c079f8a516e9142406a9fc12cbb409f9bf8681f2ddfe0360b52a6","sha512":"3747ebe9941b68e1227ff95d5de76bc2a232ee4fb975ba5704050c90d517186e5a7bbaa2335774ea04c75a278811939f507875aa8a70a44fc2ca767598342645","ssdeep":"3072:ncBRRL0RXA3+l2ZxfIdMqhX/41aUGNCGIIlA/zUNf1W4H8yiaEagOlcgGBt:0RYRw39ZhIlhXwHiAKf1XDiYuP","tlshash":"47e312aee37f83402215734fcb4a2562a0c1d8a696f12d27bb9ed1ab3d6ec5e44c4315","first_seen":"2023-04-07T03:14:12Z","last_seen":"2026-08-06T15:51:00.413295Z","times_seen":6358,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":64,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null}]}},{"url":{"schema":"http","addr":"91.92.240.66:3434/socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8mHB","fqdn":"91.92.240.66","domain":"91.92.240.66","tld":""},"ip":{"addr":"91.92.240.66","port":3434,"asn":0,"as":"","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://91.92.240.66/","date":"2025-10-23T08:15:21.678Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=polling\u0026t=PeG8mHB HTTP/1.1\r\nHost: 91.92.240.66:3434\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nOrigin: http://91.92.240.66\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://91.92.240.66/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With\r\nAccess-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE\r\nAccess-Control-Allow-Origin: http://91.92.240.66/\r\nContent-Type: application/octet-stream\r\nDate: Thu, 23 Oct 2025 08:15:21 GMT\r\nContent-Length: 85\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"87708d3f46829705604e22175a998a3b","sha1":"27bc460cf06d529fb2c38f772864f8dfc4b87cb2","sha256":"bccaca27ffaefe5bef2aa9fb34f0ad0d9e2cc2ebafc7a78c28abdeaa142d3f86","sha512":"b52183f1931e01ceb586dfb8ad51b97e7e9d399a5470e669717a399362a963e7fa5b04434abb3053d17ba27509adef033db44cb270f46ea859786e0f88e394fd","ssdeep":"","tlshash":"74a01204d56eb385eb203a4020f20a064818785d86c1048c322c088401c62106112327","first_seen":"2025-10-23T08:15:52.901181Z","last_seen":"2025-10-23T08:15:52.901181Z","times_seen":1,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}