{"report_id":"d34cb50d-b87e-43d2-8a9d-5ca3098631dd","version":6,"status":"done","tags":[],"date":"2024-04-03T12:00:11Z","url":{"schema":"http","addr":"weplaycs.de/login.php","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"172.67.174.235","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"weplaycs.de/login.php","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"title":"Checking your browser...."},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-25T20:44:44Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":439,"first_seen":"2012-09-30 02:15:09","last_seen":"2024-04-02 18:12:39","alert_count":0,"request_count":1,"received_data":26137,"sent_data":473,"comment":"","tags":null,"fingerprints":null},{"fqdn":"weplaycs.de","ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2023-10-21 22:22:36","last_seen":"2024-03-23 01:02:26","alert_count":7,"request_count":4,"received_data":11879,"sent_data":1981,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":[{"sensor_name":"phishtank","sensor_type":"url","title":"","description":"PhishTank","scan_date":"2024-03-19","alert":"Steam","trigger":"weplaycs.de/favicon.ico","verdict":"phishing","severity":"medium","comment":"Steam","link":"http://phishtank.com","meta":null},{"sensor_name":"phishtank","sensor_type":"url","title":"","description":"PhishTank","scan_date":"2024-03-19","alert":"Steam","trigger":"weplaycs.de/login.php","verdict":"phishing","severity":"medium","comment":"Steam","link":"http://phishtank.com","meta":null},{"sensor_name":"phishtank","sensor_type":"url","title":"","description":"PhishTank","scan_date":"2024-03-19","alert":"Steam","trigger":"weplaycs.de/login.php","verdict":"phishing","severity":"medium","comment":"Steam","link":"http://phishtank.com","meta":null}]},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}]},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"weplaycs.de/login.php","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8db0592536a77cc70b17ecd569a6f750","sha1":"077be07e95a796da26ac445a658529ccca39b780","sha256":"0d369ea6036a10c3dd9156e4c70103050bdc7643201866e0bede8331108cf075","sha512":"da6b1693beacdfd23334804322955489474d68951fb50589018e1435564e09907d84c472622c02b9c4a93a8527c6c1f7f688b79f652a21d85bb54eb0cb5d18d8","ssdeep":"","tlshash":"0d600000cc0c0f00f0000030cf03cc0030000030c3000f300030000000000000030000","size":13,"data":"","first_seen":"2023-08-02T18:09:52Z","last_seen":"2026-07-05T20:55:54.326767Z","times_seen":325,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"weplaycs.de/antibot9/static/peel.js?bannerid=1712145586","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ff576caa46a7e1c1a30263468be4dd9","sha1":"4051e9b6923ca4a27e5a1281ad62957fe48106e6","sha256":"3ef1fb785b8a62ea089275b16c81bc5f1232392e4d8c20896863658308b3f1d2","sha512":"feb22cfc1bc670d070325cc9d0d073895b3b394d4785b0474288cfedbd25b2a245066df59f4a5d03cac9c1a77254759b7eae810dca0950d469450de521ac17d3","ssdeep":"","tlshash":"137000080a20082ab0002e02ce028082000000a2a303f020a88280a2080c28382a0083","size":20,"data":"","first_seen":"2023-03-07T13:52:26Z","last_seen":"2026-07-22T21:23:25.493235Z","times_seen":1149,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"weplaycs.de/login.php","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","size":0,"data":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-24T13:51:00.341934Z","times_seen":17503534,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://weplaycs.de/login.php","date":"2024-04-03T11:59:46.864Z","timestamp":1712145586864,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2023 Q3","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 27 Sep 2023 18:13:13 GMT","end":"Mon, 28 Oct 2024 18:13:12 GMT"},"fingerprint":{"sha1":"05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09","sha256":"0F:90:CD:B5:CD:3B:AE:F1:BB:01:3A:4D:6D:2E:A6:BA:98:C6:1B:1B:75:BE:DD:CB:39:33:E8:D1:21:F1:9F:EF"}}},"request":{"raw":"GET /npm/bootstrap@5.0.2/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://weplaycs.de\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://weplaycs.de/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 5.0.2\r\nx-jsd-version-type: version\r\netag: W/\"260c5-fByeBXPlzqi603M74vxjqoxo6o0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Wed, 03 Apr 2024 11:59:46 GMT\r\nage: 25668828\r\nx-served-by: cache-fra-eddf8230097-FRA, cache-hel1410022-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 25360\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":25360,"size_decoded":155845,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65306)","md5":"abe91756d18b7cd60871a2f47c1e8192","sha1":"7c1c9e0573e5cea8bad3733be2fc63aa8c68ea8d","sha256":"7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b","sha512":"bac54101debafcda5535f0607b5f60c2cda3e896629e771ad76ac07b697e77e4242d4f5f886d363b55fc43a85ea48a6bfc460a66f2b1fc8f56b27ba326e3a604","ssdeep":"1536:d0bwW83RipVVsEBpy0cuJcf22RWb5CyVUpz600I4fM:d0bwlyVUpz600I4fM","tlshash":"09e3a3d7f581241dd4a7c259a0d1bffd052f4586e3025babb0277bb88b8a6c70963e4c","first_seen":"2023-04-05T03:16:49Z","last_seen":"2026-07-24T11:12:42.597946Z","times_seen":98662,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":64,"dns":5,"connect":27,"send":0,"wait":27,"receive":7,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"weplaycs.de/favicon.ico","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://weplaycs.de/login.php","date":"2024-04-03T11:59:47.133Z","timestamp":1712145587133,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"weplaycs.de","organization":""},"issuer":{"commonName":"GTS CA 1P5","organization":"Google Trust Services LLC"},"validity":{"start":"Fri, 16 Feb 2024 20:43:26 GMT","end":"Thu, 16 May 2024 20:43:25 GMT"},"fingerprint":{"sha1":"3A:AC:66:31:A1:F6:FA:64:F4:C4:09:F9:F8:3B:19:AF:1C:AE:58:B9","sha256":"E2:79:05:0D:F5:16:66:6F:1C:A1:9C:4C:53:06:3E:A7:8E:E9:85:1B:4F:CE:A0:4F:27:09:41:B8:0A:8B:BA:B8"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: weplaycs.de\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://weplaycs.de/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Ahsuby=WuTRGrQHXFDtsoNOlKZgESmyjUzdPk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Wed, 03 Apr 2024 11:59:47 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=73LNPz%2F%2FQCsO1qdPp2%2BP4N9C%2Bw9w7H%2Bi3tTbckJ7GWTa5ioLawrtbdIcJVaySvonDXrbbZLlT%2BZ4l6nq%2BS%2BrSpZCqSXJSFl94ak%2FSHnQRFFrt9IM%2BeP4O5ZieeeHlw%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 86e8e4ff99ca7127-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":273,"size_decoded":273,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text, with no line terminators","md5":"5d968a24439c088091a5cbde4ad974a3","sha1":"da22d33778c6ee9e6c43e2394a38039130b20799","sha256":"6dc4dc7d827d3932de1767b590f78948eb584488c7a1019d35abb87b67cc9954","sha512":"a20c06adb29308a9419468dc7f55d73ad0728046f211d5f420a2e2949de52398c4a8bdf94b9daa1ae12884012bdeaf1d5ee0c9213a102ffc36ae855c8df9da4c","ssdeep":"","tlshash":"ead02bbf9062a287449218e027c31191164d82f5752f02f87dc9d54a75a803dcd67dc8","first_seen":"2024-08-20T06:12:16.57537Z","last_seen":"2024-08-20T06:12:16.57537Z","times_seen":1,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"phishtank","sensor_type":"url","title":"","description":"PhishTank","scan_date":"2024-03-19","alert":"Steam","trigger":"weplaycs.de/favicon.ico","verdict":"phishing","severity":"medium","comment":"Steam","link":"http://phishtank.com","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"weplaycs.de/login.php","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-04-03T11:59:46.520Z","timestamp":1712145586520,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"weplaycs.de","organization":""},"issuer":{"commonName":"GTS CA 1P5","organization":"Google Trust Services LLC"},"validity":{"start":"Fri, 16 Feb 2024 20:43:26 GMT","end":"Thu, 16 May 2024 20:43:25 GMT"},"fingerprint":{"sha1":"3A:AC:66:31:A1:F6:FA:64:F4:C4:09:F9:F8:3B:19:AF:1C:AE:58:B9","sha256":"E2:79:05:0D:F5:16:66:6F:1C:A1:9C:4C:53:06:3E:A7:8E:E9:85:1B:4F:CE:A0:4F:27:09:41:B8:0A:8B:BA:B8"}}},"request":{"raw":"GET /login.php HTTP/1.1\r\nHost: weplaycs.de\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 03 Apr 2024 11:59:46 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 18 Aug 1994 05:00:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\nset-cookie: Ahsuby=WuTRGrQHXFDtsoNOlKZgESmyjUzdPk; expires=Thu, 03-Apr-2025 11:59:46 GMT; Max-Age=31536000; path=/; SameSite=Lax\r\nx-robots-tag: noindex\r\nstatus: 200 OK\r\nvary: Accept-Encoding\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=QoG8YE2q6eMkn2WokMovZ1qLAwvOVl17SdWbzv9X%2F1%2BXkQNVQ%2BddKjROMAAxKDvmIQZKIs%2FHfsmAFzWrGgFLrPQl6ViOH6jnrvVOHYDr9udh8c4LfFn4i%2FWdMaHe1Q%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 86e8e4fbdf2db527-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8657,"size_decoded":8657,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (8946), with no line terminators","md5":"5036e34ceabafd8154b5eb03b7893aa5","sha1":"a06e152f03ad48b9e176c47d96f9c81a2cf84845","sha256":"ea524dd6279a9ad8387b830d7698e55bd4ee022dc8a52278ff7b1443082c5a99","sha512":"f959f61e8f57b5b77287b2fbb7752dcaeebfab2ffd8c13e87ef6fa979bc0668a1584a760e629f722c2a04684fb00339b259e3b476974ecfeb6b4aabe96610d81","ssdeep":"192:jSHMRpDQFM4JPVRG8mfEJeESmIEfT7BNR2sZQW:jRDQe4JPVQ8mfYSmIuBNRNX","tlshash":"200229afb8015534390b3e75fbf7935a3870b104093252247e5c129f5b69f48cdabe9a","first_seen":"2024-08-20T06:12:16.576376Z","last_seen":"2024-08-20T06:12:16.576376Z","times_seen":1,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":13,"dns":0,"connect":1,"send":0,"wait":170,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":[{"sensor_name":"phishtank","sensor_type":"url","title":"","description":"PhishTank","scan_date":"2024-03-19","alert":"Steam","trigger":"weplaycs.de/login.php","verdict":"phishing","severity":"medium","comment":"Steam","link":"http://phishtank.com","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"weplaycs.de/antibot9/static/peel.js?bannerid=1712145586","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://weplaycs.de/login.php","date":"2024-04-03T11:59:46.866Z","timestamp":1712145586866,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"weplaycs.de","organization":""},"issuer":{"commonName":"GTS CA 1P5","organization":"Google Trust Services LLC"},"validity":{"start":"Fri, 16 Feb 2024 20:43:26 GMT","end":"Thu, 16 May 2024 20:43:25 GMT"},"fingerprint":{"sha1":"3A:AC:66:31:A1:F6:FA:64:F4:C4:09:F9:F8:3B:19:AF:1C:AE:58:B9","sha256":"E2:79:05:0D:F5:16:66:6F:1C:A1:9C:4C:53:06:3E:A7:8E:E9:85:1B:4F:CE:A0:4F:27:09:41:B8:0A:8B:BA:B8"}}},"request":{"raw":"GET /antibot9/static/peel.js?bannerid=1712145586 HTTP/1.1\r\nHost: weplaycs.de\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://weplaycs.de/login.php\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Ahsuby=WuTRGrQHXFDtsoNOlKZgESmyjUzdPk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 03 Apr 2024 11:59:46 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Mon, 18 Dec 2023 08:24:26 GMT\r\netag: W/\"658001ba-14\"\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=mqHdJf2rQTu01iK9Wg8yPrlEIMgFu2gKs9BaBvF9WNLwljH2laZxg7KjW0OGLg9qoCG8rt8jhs0C%2BztQgcYR88HRjx3gE26929FiPLC5L0uzuUZ%2FXvWgW2HoN%2BRVtw%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 86e8e4fdeff27127-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":20,"size_decoded":20,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"40c5c65eebd5db5f0079592a56dd5fb0","sha1":"44906de6d119b523590db0cfa1eb59da0f999198","sha256":"3e67eb22d594608fa62fcb94d9b5ea6fe7e62a9aa34b6add30ece22ece89a43c","sha512":"5510b597e3e8fbd41c32bd30ba8824f5cd291fc361544ec7062c1d23814d5c4e323e6a668c7fb3a70b47ab65e2e63d78ae1a6ab2bb907a639bf3e8bd17b8669f","ssdeep":"","tlshash":"857000080a200808b0002e00ce028082000000a2a303f020a88280a2080808380a0083","first_seen":"2023-05-25T13:13:03Z","last_seen":"2025-04-04T12:03:41.595501Z","times_seen":65,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"weplaycs.de/login.php","fqdn":"weplaycs.de","domain":"weplaycs.de","tld":"de"},"ip":{"addr":"104.21.31.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://weplaycs.de/login.php","date":"2024-04-03T11:59:47.047Z","timestamp":1712145587047,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"weplaycs.de","organization":""},"issuer":{"commonName":"GTS CA 1P5","organization":"Google Trust Services LLC"},"validity":{"start":"Fri, 16 Feb 2024 20:43:26 GMT","end":"Thu, 16 May 2024 20:43:25 GMT"},"fingerprint":{"sha1":"3A:AC:66:31:A1:F6:FA:64:F4:C4:09:F9:F8:3B:19:AF:1C:AE:58:B9","sha256":"E2:79:05:0D:F5:16:66:6F:1C:A1:9C:4C:53:06:3E:A7:8E:E9:85:1B:4F:CE:A0:4F:27:09:41:B8:0A:8B:BA:B8"}}},"request":{"raw":"POST /login.php HTTP/1.1\r\nHost: weplaycs.de\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://weplaycs.de/login.php\r\nContent-type: application/x-www-form-urlencoded;\r\nContent-Length: 512\r\nOrigin: https://weplaycs.de\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Ahsuby=WuTRGrQHXFDtsoNOlKZgESmyjUzdPk\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Wed, 03 Apr 2024 11:59:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nexpires: Thu, 18 Aug 1994 05:00:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\naccess-control-allow-methods: POST\r\naccess-control-allow-origin: *\r\naccess-control-allow-headers: *\r\nx-robots-tag: noindex\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=zTaUTM%2FqAtCZCEFIk2hKtJfZnTqpTMeX3A6vRLKBzd2v9%2Bb0YHJJ6Eu7r7lwsH9wRAtlz7GzfoBInAAxoYSgEoivY39pOnwIoY6SP9F9435zIxV5siCu9jfeEYFRAg%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: 86e8e4ff092e7127-OSL\r\ncontent-encoding: br\r\nalt-svc: h3=\":443\"; ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":16,"size_decoded":16,"mime_type":"text/html; charset=UTF-8","magic":"troff or preprocessor input, ASCII text, with no line terminators","md5":"2d5353cb7af0c23d329487d27fe0ac90","sha1":"d81397433163561e8db2cd3ae145fb119402d837","sha256":"5df0a54528bb20934ad68d7198ca0948cb684fad684cab85ce94559b27af2952","sha512":"da221586e2daa55a678c85ffc5afa8b5fab944e5c1c5be2d8f017233788d0e156aceae61ed106d4bf6b8d1477b7eecab0d05b8063fbbe0bca5a574f54659bc56","ssdeep":"","tlshash":"c970000082a080028000808002220a02008880032020000008ae080a000002c0c28020","first_seen":"2023-08-02T18:09:52Z","last_seen":"2025-03-25T18:34:48.210677Z","times_seen":79,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"phishtank","sensor_type":"url","title":"","description":"PhishTank","scan_date":"2024-03-19","alert":"Steam","trigger":"weplaycs.de/login.php","verdict":"phishing","severity":"medium","comment":"Steam","link":"http://phishtank.com","meta":null},{"sensor_name":"quad9","sensor_type":"domain","title":"","description":"Quad9 DNS","scan_date":"2024-04-03","alert":"Sinkholed","trigger":"weplaycs.de","verdict":"malicious","severity":"medium","comment":"Sinkholed","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}