{"report_id":"d2b3fd6e-dbef-4fb4-a20f-b355fb73684d","version":0,"status":"done","tags":[],"date":"2026-10-01T05:39:43Z","url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/index.html","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":0,"asn":153568,"as":"NEW DHAKA HARDWARE","country":"Bangladesh","country_code":"BD"},"final":{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/index.html","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"title":"Welcome to Ever $ Green Federal Credit Union","dom":{"size":19630,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (308)","md5":"a2a95ea242e1bed7cdc41b16ada9f7f2","sha1":"48043e3f4d5b0308da97b178e6f4372cc93c4333","sha256":"ffeafa728b4c920758faf98d2b634483bfaf29f327c2b804b5c527b26891ceef","sha512":"3e94d9ac8f2dfad5e1d430fb73b830b82b2d163a2a5b3c22d8c9ebd29e44e8864aa540c957efb635a53691100c44cb521a477e162330f2bec868338d99ae80f4","ssdeep":"384:SdTCukju7rt37RFjNZJN3W4VNizVN4XUdtkzxQQtMLbydtx8dhMlDb1rKJ/R3GZs:Sd7F76pp1f3t","tlshash":"6c92b71296ce1c3b0202769931453f6cb1bf4e71c31c1999b4bf11aebb93e846bbd096","dom_hash":"domhashe62ca5bc25352a15d3edb148ea43bc37","first_seen":"2026-10-01T05:39:46.407239Z","last_seen":"2026-10-01T05:39:46.407239Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/index.html","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":0,"asn":153568,"as":"NEW DHAKA HARDWARE","country":"Bangladesh","country_code":"BD"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-05T05:39:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"onlineegcu.evgic.icu","ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-09-29","domain_rank":0,"first_seen":"2026-10-01T05:34:06.551428Z","last_seen":"2026-10-01T05:34:06.551428Z","alert_count":42,"request_count":21,"received_data":1368190,"sent_data":11511,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a09e13ee94d51c524b7e2a728c7d4039","sha1":"0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae","sha256":"160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef","sha512":"f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a","ssdeep":"1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69","tlshash":"748319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","size":86927,"data":"","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-10-01T07:54:52.721386Z","times_seen":146125,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/cdnjs.cloudflare.com/ajax/libs/foundation/6.4.3/js/foundation.min.js","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"af2faf64ef4f5cd2c9ff762170e2b227","sha1":"38b919269d571717271bba48ab0374e109eaf387","sha256":"9916250aee441bea2e0f4ed6c4b17cbf8640658080e96ae67485f29f506ff559","sha512":"d201df68c918f83a39ebc4e08c90b688c015d1d42563836a6de678a6bf655544d74332aef2a71ec9deb083fdd4aa5f6a036fb75f9347bf720c6f4e706f7f3bac","ssdeep":"1536:b1QdEJjhNrqWzah/o0KsTopDS2o+aCWsQC0ZNDHbefmmmHK3hcbOuX6JGWCNsQnG:mcjr8/o0DTos3emmmHK3osGNNsQnoR","tlshash":"45e3a74d7250313252eba5b2012f060eb2325b78b546889cb179cdf6aeb8d5c3297f7d","size":148815,"data":"","first_seen":"2023-03-07T01:06:51Z","last_seen":"2026-10-01T05:39:46.411876Z","times_seen":355,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/index.html","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f9f899f3d6e0cab77ffc90646e572fac","sha1":"6b82aa76f28e1aa39cd5f5fa325ce604b7b70a7d","sha256":"e22883a04526785bb35feb658da4974c160999432286921d7df30235cc21e4f3","sha512":"62d40da07cccd9edc5a20a7e44260e62804ecc42061e0bda4c6343ac19efc25e3b975f79c6f0b587861b1bda006d110732af847772b1e8d613db17ba28d3c6be","ssdeep":"","tlshash":"e77000a0a0a08208003b202a203280308a2b2a2028022828a00e02200a02a000202888","size":25,"data":"","first_seen":"2023-03-07T16:27:13Z","last_seen":"2026-10-01T05:39:46.425858Z","times_seen":679,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/custom.js","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"eedc70e56535ef23f306b7237ee2dd96","sha1":"2265e54cdef05f3fece8517a88a5d480d6fb5840","sha256":"043e45f19da4e45e1b7ffcab3d16aea7934b87125d617600248f9ea83c188ccf","sha512":"555264ab7c5b20745e121f6571c0409b2761b029630c2814922282b7026bba0ecbcb408d35311d3104a70b42ce7b8f7304cdaea76a183f719caa5367b8b203fc","ssdeep":"","tlshash":"1d11351d3903103fd53b37d8333795bd9ab286c474023151bc2c658591a8b8c2237d9f","size":1059,"data":"","first_seen":"2024-10-14T16:40:15.116154Z","last_seen":"2026-10-01T05:39:46.415284Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/icon-exit-green.svg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.491Z","timestamp":1790833142491,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/icon-exit-green.svg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/site-globals/custom0604.css?200413124039\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 244\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":495,"size_decoded":557,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8291449398395ba92a7eeee29d838aac","sha1":"e68b24e0279aa58ac2f4b97eaa38c02c739c2ddf","sha256":"e10cdeb79e80cd18906593bf81c43688408540d7fa830163e6278b2b4544ddcc","sha512":"0eb8749114d9efb38da90f395e48ff9ca0bb506dfa97c74bb78177d18f6beb569d2f018818c86160c4f6d8f6ccfc8020bb5b683a5a5e6b49c096f0315adc9f29","ssdeep":"","tlshash":"dbf0d4aa62986e5e352171aca0f0b8c063ff70f0a383064425e035386503c20de67d2d","first_seen":"2024-10-14T16:40:15.123394Z","last_seen":"2026-10-01T05:39:46.409793Z","times_seen":13,"resource_available":false,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/index.html","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-01T05:39:01.488Z","timestamp":1790833141488,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/index.html HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Tue, 29 Sep 2026 12:10:55 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4484\r\ndate: Thu, 01 Oct 2026 05:39:01 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"ZURB Foundation","description":"Zurb Foundation is used to prototype in the browser. Allows rapid creation of websites or applications while leveraging mobile and responsive technology. The front end framework is the collection of HTML, CSS, and Javascript containing design patterns.","website":"https://foundation.zurb.com","common_platform_enumeration":"","icon":"ZURB Foundation.png","categories":["UI frameworks"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":17373,"size_decoded":4913,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"ca3e1f3ca02fab183c5182ee57d8d5d0","sha1":"91386c89b3585c33b2b2965f1cbb5377f0d8e230","sha256":"ac446d2f4a0f3b3dc0fb8c279acba0553ba8aadd95555838007107b405b3d68f","sha512":"d8a1650a35edd0b2e54ba60d2892681d599990cc3ee6dc82d78f4dfce401a551dea6d91b9795f3f7e58528a0e05ac9c23396bc4e1705b06f502a7e09deb83ca9","ssdeep":"384:jfjvB94sq8SlSJSlS4S04rAqO8KzFO1cuY8OW8l21CyMQwnE2W9EnRgE3rygvE3N:fy7Rg","tlshash":"b9727406b38d213b0313124b2175376876afce7293295c9978bf627b77c3e449a6a097","first_seen":"2026-10-01T05:34:10.855891Z","last_seen":"2026-10-01T05:39:46.410958Z","times_seen":2,"resource_available":true,"data":null}},"time_used":552,"timings":{"blocked":-1,"dns":279,"connect":87,"send":0,"wait":88,"receive":0,"ssl":98},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/cdnjs.cloudflare.com/ajax/libs/foundation/6.4.3/js/foundation.min.js","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.242Z","timestamp":1790833142242,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /cdnjs.cloudflare.com/ajax/libs/foundation/6.4.3/js/foundation.min.js HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 04 May 2020 17:10:14 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 30637\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":148815,"size_decoded":30875,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (31995)","md5":"af2faf64ef4f5cd2c9ff762170e2b227","sha1":"38b919269d571717271bba48ab0374e109eaf387","sha256":"9916250aee441bea2e0f4ed6c4b17cbf8640658080e96ae67485f29f506ff559","sha512":"d201df68c918f83a39ebc4e08c90b688c015d1d42563836a6de678a6bf655544d74332aef2a71ec9deb083fdd4aa5f6a036fb75f9347bf720c6f4e706f7f3bac","ssdeep":"1536:b1QdEJjhNrqWzah/o0KsTopDS2o+aCWsQC0ZNDHbefmmmHK3hcbOuX6JGWCNsQnG:mcjr8/o0DTos3emmmHK3osGNNsQnoR","tlshash":"45e3a74d7250313252eba5b2012f060eb2325b78b546889cb179cdf6aeb8d5c3297f7d","first_seen":"2023-03-07T01:06:51Z","last_seen":"2026-10-01T05:39:46.411876Z","times_seen":355,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":153,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/logo-evergreen-large.svg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.248Z","timestamp":1790833142248,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/logo-evergreen-large.svg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6775\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":19868,"size_decoded":7089,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"33c0b615bd4ac5fb89c9dd4ec622ed24","sha1":"12e11036e71374e011a608e7018c29fbe2423a06","sha256":"76cd5b590a607f89b134c513918780545a6f276d65ff3c469d3bcd0729e6fabd","sha512":"1ffb83abcdadbd45ac2547b037c3ea2f6225639560a035250f9d6e57b6b4961fe6419fb38e77e8667c169fea527db6e05d321ceb698f71d2cba49bfa6cfc8c17","ssdeep":"384:8YDc1p2gKh9bTwnazBp6zKsBIxQtLxovE:5k2Nh9fwnw4RIxM7","tlshash":"cf920d7b5304dbfa9585cf88c969a09a37b5c482f1b9f1dc9fa35a169c0a8f78134c31","first_seen":"2024-10-14T16:40:15.12097Z","last_seen":"2026-10-01T05:39:46.412764Z","times_seen":14,"resource_available":false,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/images/logo-wheatland-chili-csd.jpg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.255Z","timestamp":1790833142255,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/images/logo-wheatland-chili-csd.jpg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 18 Jul 2018 21:25:16 GMT\r\naccept-ranges: bytes\r\ncontent-length: 82738\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":82738,"size_decoded":83005,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: \"*\", progressive, precision 8, 863x846, components 3","md5":"de6a4089387b8e8e5e222b7eda2c51bd","sha1":"d0dfb6979daab83189f0afab6215148fe2a9e641","sha256":"911b297a4ccd9bc5624a0afcdd7f9e611d4bed06c0a62cca8e860b9223575fd1","sha512":"e6139157ab39670a49636efd206634a7609f446c84fda6c29b2a2b80ef544ef41382dccc86661c9b979dd2e4e854f17b94f169901f7a47bfc800d9487e0ffafd","ssdeep":"1536:V7FIX2c/w23szjcSfDlOKVxmPKkWxRg6j6TG5h3xISokLUT0iL+:kXp/wpzIeDl33m0xRg6j6q5kSoaBiK","tlshash":"e68302f8af911208e11837725c6a33546e11cdd99ad71ca3ec22657c3caf7b49871ec9","first_seen":"2025-10-27T14:36:50.351998Z","last_seen":"2026-10-01T05:39:46.413494Z","times_seen":3,"resource_available":false,"data":null}},"time_used":507,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":475,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/bgd-viewport.jpg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.488Z","timestamp":1790833142488,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/bgd-viewport.jpg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/site-globals/custom0604.css?200413124039\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-length: 211840\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":211840,"size_decoded":212108,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2880x683, components 3","md5":"eb80f3e024c62c8bcf00e26f6a3d8644","sha1":"29e2074d1281df6c19a10c06317def05267c7b37","sha256":"e10342316fb46abc0fa02634f846722f12bb2056085d85977f229f2d9ff5418d","sha512":"dd2d3b6b22037d5d6863254a6753c21aaf056588b219ceda11d4e71f8c6aa261de41043621847e116352f5531d2dd285e765dc5d4a37aa82229b0226a8b9c396","ssdeep":"3072:ofouPj8bnSsc5XW3FLxUMHrGpn/vq3I63x8CQGG32Vl/fbflPkDxXfidtR5ta:ufPj8HQGhiMLYnqI6B8COUblIPiJC","tlshash":"002413b9a073601ee80ab9bb3dc499d00e54581153809fc1ead3de9792bd5fd27f701a","first_seen":"2024-10-14T16:40:15.127819Z","last_seen":"2026-10-01T05:39:46.414479Z","times_seen":14,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":257,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/custom.js","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.244Z","timestamp":1790833142244,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/custom.js HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Wed, 18 Jul 2018 21:25:20 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 476\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1059,"size_decoded":712,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"eedc70e56535ef23f306b7237ee2dd96","sha1":"2265e54cdef05f3fece8517a88a5d480d6fb5840","sha256":"043e45f19da4e45e1b7ffcab3d16aea7934b87125d617600248f9ea83c188ccf","sha512":"555264ab7c5b20745e121f6571c0409b2761b029630c2814922282b7026bba0ecbcb408d35311d3104a70b42ce7b8f7304cdaea76a183f719caa5367b8b203fc","ssdeep":"","tlshash":"1d11351d3903103fd53b37d8333795bd9ab286c474023151bc2c658591a8b8c2237d9f","first_seen":"2024-10-14T16:40:15.116154Z","last_seen":"2026-10-01T05:39:46.415284Z","times_seen":13,"resource_available":true,"data":null}},"time_used":245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/images/branch-building-paint.jpg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.253Z","timestamp":1790833142253,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/images/branch-building-paint.jpg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 18 Jul 2018 21:25:16 GMT\r\naccept-ranges: bytes\r\ncontent-length: 227457\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":227457,"size_decoded":227725,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1600x640, components 3","md5":"c339cb9c7a0df5873b22ecaa0ae86041","sha1":"0fc2ce54424a6263917ea4b43b72a2f1819c6e3b","sha256":"46f921cad0dc9dc90ed58d63abf2b5f87528734f0aad9ac84ec931887e382394","sha512":"124c497598a6281d4cb9d1cb48be63b39a04b3b7feec2c20735d1f87ba4381c55d0638adb4ce3f8835d7c26096684823a394b03a99f679911c482905daacdba7","ssdeep":"6144:t/EVwlUTAI6Kd/f5KqvFBkoCV84SGu+HbjNN:NzWrKqPCn2ojNN","tlshash":"662423bb3776e928de774a3d0a5f83940ce89d196066a3df483cc902994f147fbb1641","first_seen":"2025-10-27T14:36:50.373778Z","last_seen":"2026-10-01T05:39:46.415905Z","times_seen":3,"resource_available":false,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":249,"receive":179,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/images/Enterprise-hp.jpg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.257Z","timestamp":1790833142257,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/images/Enterprise-hp.jpg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 22 Nov 2019 16:58:24 GMT\r\naccept-ranges: bytes\r\ncontent-length: 122631\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":122631,"size_decoded":122899,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2019:11:22 09:58:17], baseline, precision 8, 638x479, components 3","md5":"75c98e8025091940628aad779100872a","sha1":"770ae533e6d5c1f84f59e542da94d9decdca1246","sha256":"5eb505f6d2ffd6eb00fa11b5c0a45593e8c01e984743712efdb96389ceb123c4","sha512":"51027aab530db008527cd84522364339ce4cc670f6a197fe1b9df7be0b390d54229d3aadf0af91ae7b35008343c7fed830d226aa314d103cf6f179ad6214885a","ssdeep":"3072:dgScjoNQc6XSQYB7t6RcMwnFU/IQUm6RGL5Hr0:NyoKc6XSQYjacMmUHI4L0","tlshash":"c5c3e0987b72f0d2c21a967cbcf74148675cefb25b0237817c9c29341ba91c4b98a27d","first_seen":"2025-10-27T14:36:50.357413Z","last_seen":"2026-10-01T05:39:46.416635Z","times_seen":3,"resource_available":false,"data":null}},"time_used":534,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/logo-ncua-symbol-black.svg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.262Z","timestamp":1790833142262,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/logo-ncua-symbol-black.svg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 512\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1080,"size_decoded":825,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d4737dbf08f9fd89d2aba9be42391628","sha1":"3573558d40ddd07116455dac073d16ccdd6e88d5","sha256":"56daaeadcba24433ef4c4f28ddfd1eeac1e0ff4d028fd955d7e595d353f4f265","sha512":"e9e75a5fc108dff7a73cc7ea1d55c9e50fbff1473315307ff790b83a6f19c5670faa5b0db201e64fbe927c09fa99f8277603928ae556bc9e4decad1cc63f7a12","ssdeep":"","tlshash":"4011426693293c7da05307299715b1637072b4e1d35e82dcf1d0393b0701aa3b87470b","first_seen":"2024-10-14T16:40:15.119028Z","last_seen":"2026-10-01T05:39:46.417475Z","times_seen":13,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/icon-website-196.png","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.856Z","timestamp":1790833142856,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/icon-website-196.png HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-length: 9573\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":9573,"size_decoded":9838,"mime_type":"image/png","magic":"PNG image data, 196 x 196, 8-bit/color RGB, non-interlaced","md5":"578b9728021f07647d76737f4a8c77e1","sha1":"2558f8b09c944207f5d551b1c265ac156b4f9bdd","sha256":"c898d71d954b34001adca172c7d98f59556c7083c64c14f3a65a434aa64b3aa8","sha512":"bb2914d007dc06bcd474ca77d33551cafcf3503571e916213ec5386b26f46059fbf2d2237c44cd18a31a8edd3179094ef95a60e1f1b62f3d3853e2a01eed9a8d","ssdeep":"192:Wtn68EAMzXxSSCnPemuuoefTQTZiO+rfxLdwD9:WNCAMzXSvB0TZb+rUD9","tlshash":"1b129ffce6f8272598161f1deed768769d018d9325a07b430f9f44c5e9bb248618cc71","first_seen":"2024-10-14T16:40:15.132442Z","last_seen":"2026-10-01T05:39:46.418124Z","times_seen":14,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/custom0604.css?200413124039","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.235Z","timestamp":1790833142235,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/custom0604.css?200413124039 HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Apr 2020 13:40:40 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 4956\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22446,"size_decoded":5265,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"aba8ff16ef751573da1044d437a190aa","sha1":"ccf9c663e907bc4fe113bcf4ad5e02ac3a1e0be7","sha256":"8e80779a89892f4e1b82684478104168e43e80695daa1c67805b3ff89a2f4ce3","sha512":"90b67f2eb04a6764a5ef8076c55f7d5b76e47ccfa04bfb8b099fdcbd419cd2093c557f717db232398234be33209b2e988f6f5df2f5fba3f43cf09fc0fcb3b552","ssdeep":"384:jOj9PJ3CzOEVJO6pReOPSjcJemAKNlJtGMdjTtMONh99iQ9SA5GTt6/v:jeJyzOEDxpEOPSjcJeDt6/v","tlshash":"45a2c8a927423d1c5312db1463f5baf49f3a08a0df5f2dfcb8867788a3cd65825b2254","first_seen":"2024-10-14T16:40:15.10915Z","last_seen":"2026-10-01T05:39:46.418772Z","times_seen":13,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":112,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/logo-evergreen-medium.svg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.251Z","timestamp":1790833142251,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/logo-evergreen-medium.svg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 6406\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":19528,"size_decoded":6720,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8c974b562eef86bad587b499d5ddd98a","sha1":"378b585ae1ca7435c3ec0f6325629a186d3b1a26","sha256":"8a84b1414eb4356e4b2b5003863b66f649b2f1dcbcb8817ef27bc917a81b4a40","sha512":"585fcce7d0873dd7c3a01106ca8b100c5e458f47bd6c42502cbdfa62400bc6dcb506376716b922705efca1224299ba146d8b22004590d1c6c371698b49627459","ssdeep":"384:gYZMYK1DFT2sBT4/aheyd7U/3R/NEwH4GejvM0wes8R+Qy5kQMkNaveLvsm5ub5G:JKWsBECFBkRSwH4nvM9y5eLMkEokqub4","tlshash":"9192567b5314d7fa9ac1cb44c669a08937d6c082f1fae1ec8fab65965c058fbc1b4c21","first_seen":"2024-10-14T16:40:15.130251Z","last_seen":"2026-10-01T05:39:46.419401Z","times_seen":14,"resource_available":false,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":114,"receive":140,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/images/loan-application.jpg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.259Z","timestamp":1790833142259,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/images/loan-application.jpg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 18 Jul 2018 21:25:16 GMT\r\naccept-ranges: bytes\r\ncontent-length: 89984\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":89984,"size_decoded":90251,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=©2016fstop123], baseline, precision 8, 860x573, components 3","md5":"7404050fe6503a0d18a09516f085bb53","sha1":"31bf286ccf0a78dcb39e47c48d103d8d8b5d8320","sha256":"bbde29861694e9aa0a270cab89284c6a56d1790b58150186d477c7b7538c6c30","sha512":"8897dec30915d802d49f09acaca390f80166936a84d3eeefacad9f523951bc8f7bf3d9b66fcb45ea6290285cdde009ea9c60f1171d179fdb632c4bc51a1402de","ssdeep":"1536:SAYDBcEdPOZIa9C2HBhsoRKa14Cqxu3rHvUAwUSTDWC1TQEW20v1PzBjKRWgPzKW:SAkFVEtbhKaFqxu1SGOTBUdPVUbKgm0x","tlshash":"ec93029987d69f8bea1e53f9b1be49540c1d901dbeb5f530bb481b90fa230c11973d44","first_seen":"2025-10-27T14:36:50.358403Z","last_seen":"2026-10-01T05:39:46.42Z","times_seen":3,"resource_available":false,"data":null}},"time_used":547,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":376,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/images/check-ordering.jpg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.260Z","timestamp":1790833142260,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/images/check-ordering.jpg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 18 Jul 2018 21:25:16 GMT\r\naccept-ranges: bytes\r\ncontent-length: 47981\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":47981,"size_decoded":48248,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, copyright=www.peopleimages.com-licence restrictions apply       ], baseline, precision 8, 860x573, components 3","md5":"e36bcc9ce5cf7278bc6f057106d807bf","sha1":"ef78b9493afd0855c4154a4895c04066ceaf7aa2","sha256":"908368d692cd04a3799c9b98ce60245ca07c74c0131e57d2925a26a10f8d768e","sha512":"30a9d2e8690cb0a1d9d87a13ce540479661e3d0087892d3142b00428973494e7462dc7273425024c4d3f5c8de06dd3944e70374759ecdc46e94477bd234fd906","ssdeep":"768:EAYymikJ8W0+Vsb4J2KFinlj3lSo1331BbW0OfUSi+L40SYOFa:EAyig8RmsbQ2NlSoJ315W9fp00hea","tlshash":"7b230222770b576af174bb7e06fb0d87e2b12b28c745f8e9e3b9767a04136405d4205e","first_seen":"2025-10-27T14:36:50.367015Z","last_seen":"2026-10-01T05:39:46.420817Z","times_seen":3,"resource_available":false,"data":null}},"time_used":568,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":183,"receive":385,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/icon-exit-white.svg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.489Z","timestamp":1790833142489,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/icon-exit-white.svg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/site-globals/custom0604.css?200413124039\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 242\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":492,"size_decoded":555,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1c779c501214ad13760bada373015514","sha1":"4df0a202f705a2a45dbe501013c143e8e0fbc2df","sha256":"232c68e04aabe469b76370eb69d889ae0478ad5876f16ff383fa185f6baabbfa","sha512":"d91bf20006d270906428c220a8c1687614218459e1c5acd2b9dd81a8947b95bbd9e8aa8cb5fce5105a6d911a7521d4fc845463c4899a0f1dd053f9909c668e0e","ssdeep":"","tlshash":"4df0d48b52947d5f361171aca0b078c063bfb0e0e383054425e4353ca503c20dd67d2d","first_seen":"2024-10-14T16:40:15.12572Z","last_seen":"2026-10-01T05:39:46.421414Z","times_seen":13,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/icon-website-16.png","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.858Z","timestamp":1790833142858,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/icon-website-16.png HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-length: 620\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":620,"size_decoded":884,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced","md5":"0c61c9526192a0e978e467606c3872cb","sha1":"06a9ce14cee013ec9376b6af3a75f6a1cae9ae07","sha256":"220bb295c2d8b6dffffba2d860bcf65e84eb38466e05d2f708f9b0541ab3046c","sha512":"00e4e575d4f384104cbfc54e582bc16d9f562ee5125c7a281cacb68b826f90db5268d28765b66724b52b42b2549ecb391e2ec81637fe6707543033f5fbaebf61","ssdeep":"","tlshash":"2ff002cfea408bd98a26705b9c75008ad8a3b62565f09510098f88366265923f4f8ea4","first_seen":"2024-10-14T16:40:15.134437Z","last_seen":"2026-10-01T05:39:46.422073Z","times_seen":14,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/cdnjs.cloudflare.com/ajax/libs/foundation/6.4.3/css/foundation.min.css","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.231Z","timestamp":1790833142231,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /cdnjs.cloudflare.com/ajax/libs/foundation/6.4.3/css/foundation.min.css HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 04 May 2020 17:10:14 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 14931\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":120426,"size_decoded":15419,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65534), with no line terminators","md5":"b2ffd1cd44b33a6ea0373900c135b048","sha1":"d0c8ed9a2330f57d4c2c892a464ee4bdbcf30eb4","sha256":"1928a8f2a6a66976a933c16af4961d18d4ef93f760b3e70c2e03de7af398131d","sha512":"40711bea3382f126864e6626194d7dbb616121f786fadfe149a70858fa43ccea79cb2827b612f72709e294cecb33574e01b26feb647efc52027ecaca52abf81a","ssdeep":"3072:szwVy1EnmJ4bbitKge8/KtIr2ZB/3UZuRY7a9kHvSfxqjldahVNtxvxNJ5LU32XB:wv3ad","tlshash":"71c3fab62150330cc053ce12a5e659a86337cc22e611e6febde36d59c787b842573af6","first_seen":"2023-05-31T15:39:40Z","last_seen":"2026-10-01T05:39:46.422747Z","times_seen":87,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.240Z","timestamp":1790833142240,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Mon, 04 May 2020 17:11:48 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 29664\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":86927,"size_decoded":29902,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"a09e13ee94d51c524b7e2a728c7d4039","sha1":"0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae","sha256":"160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef","sha512":"f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a","ssdeep":"1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69","tlshash":"748319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","first_seen":"2023-03-07T01:02:02Z","last_seen":"2026-10-01T07:54:52.721386Z","times_seen":146125,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":134,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/images/logo-rush-henrietta-csd.png","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.254Z","timestamp":1790833142254,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/images/logo-rush-henrietta-csd.png HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 18 Jul 2018 21:25:16 GMT\r\naccept-ranges: bytes\r\ncontent-length: 126810\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":126810,"size_decoded":127077,"mime_type":"image/png","magic":"PNG image data, 407 x 424, 8-bit/color RGBA, non-interlaced","md5":"b6843ca45674122b616008fe6cd8c258","sha1":"a2e43e897961e5c9c2f4d6883642ac5032112a4e","sha256":"05b25e47aac80783d710ce556853ddde555c6539e88f4698f4637bd06c038134","sha512":"e7531e76a142dfc25b55155faf641f89e7488c377477623203c5ce061d3c0566856a2c6a94175dc50ab598135ecb2a9fb12425a70c84638f74ffc7d288021f1c","ssdeep":"3072:j9TZ4tbRoK7oAC5FAKj8V29376zB1w3shOsq1fFKu47g:5TQoK7oAC5+KjGXam3Pc","tlshash":"6ac312ae538c2fb2dd15875af92d0332b56c5c071c229bf18ed425e9a64e283fe55334","first_seen":"2025-10-27T14:36:50.35617Z","last_seen":"2026-10-01T05:39:46.42416Z","times_seen":3,"resource_available":false,"data":null}},"time_used":486,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":425,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"onlineegcu.evgic.icu/en/site-globals/images/logo-equal-housing-lender.svg","fqdn":"onlineegcu.evgic.icu","domain":"evgic.icu","tld":"icu"},"ip":{"addr":"163.61.188.2","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://onlineegcu.evgic.icu/en/index.html","date":"2026-10-01T05:39:02.264Z","timestamp":1790833142264,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"onlineegcu.evgic.icu","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 29 Sep 2026 09:53:12 GMT","end":"Mon, 28 Dec 2026 09:53:11 GMT"},"fingerprint":{"sha1":"2B:15:93:7B:14:1D:AB:D4:66:AA:DC:F3:B0:C1:0E:0B:64:34:9F:8A","sha256":"0C:EE:86:15:B2:8F:37:94:C0:2A:31:CC:EB:5F:DF:D4:B5:6D:57:F6:AA:85:8B:29:56:86:4E:8B:A2:BB:3B:AD"}}},"request":{"raw":"GET /en/site-globals/images/logo-equal-housing-lender.svg HTTP/1.1\r\nHost: onlineegcu.evgic.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://onlineegcu.evgic.icu/en/index.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Thu, 08 Oct 2026 05:39:02 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 18 Jul 2018 21:25:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 1678\r\ndate: Thu, 01 Oct 2026 05:39:02 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3827,"size_decoded":1992,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e800974091c26623e387eb01ff3586a5","sha1":"a5011796015dda46511a63733fcd4410d264ac50","sha256":"15686ae705501c88ef046c2d353a18d6b143b1d5473e9d15e9fd8905bdb57cf9","sha512":"2d8fd517a768586874e85fda60cc6c03def13c014f3f68a3dea514949fe7f81ed31a1f9f033b78f0bb97cf83765d69358a46d33ac018eae4add7f06cb43b24a8","ssdeep":"","tlshash":"a58197ebab21d0fc598b4d77df37a8dc3c1675fc6b120541832ed91658d39e88b08a48","first_seen":"2024-10-14T16:40:15.11149Z","last_seen":"2026-10-01T05:39:46.425145Z","times_seen":12,"resource_available":false,"data":null}},"time_used":562,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":376,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-01","alert":"Sinkholed","trigger":"onlineegcu.evgic.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}