{"report_id":"dbc4467f-af63-4d99-8120-d06a6d4d3a2b","version":0,"status":"done","tags":["google"],"date":"2026-08-26T11:07:38Z","url":{"schema":"http","addr":"mvkpop.es/workspace/voicem9303.html","fqdn":"mvkpop.es","domain":"mvkpop.es","tld":"es"},"ip":{"addr":"15.204.131.23","port":0,"asn":16276,"as":"OVH SAS","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"mvkpop.es/fd6d5d61-9326-4621-a907-420fb67918bc#","fqdn":"mvkpop.es","domain":"mvkpop.es","tld":"es"},"title":"Sign in - Google Accounts","dom":{"size":1410,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"1414679310b377dfdf3e283d66cfef7d","sha1":"2ecaf1199a4177d5ad2e2a3c8b0eee3a7cb91a06","sha256":"0c3cd5f85a255d28c572101288ff4c8716cf85705254f31d6c4b1850c4d1351e","sha512":"5a6255a4b5e14406b448e258d037f39473666486dda762a47307ad0882e983e428f49578274c68a43bcfed8dc9d60e882788082c4ba32dcf51e4f635316a61f7","ssdeep":"","tlshash":"97210f9324b594251612849274b7b69c18a5714b3e04dd8d31cd91699f44fa7cce3afc","dom_hash":"domhash84382c593afbe02c16f0582e22525593","first_seen":"2026-08-26T11:07:41.126086Z","last_seen":"2026-08-26T11:07:41.126086Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mvkpop.es/workspace/voicem9303.html","fqdn":"mvkpop.es","domain":"mvkpop.es","tld":"es"},"ip":{"addr":"15.204.131.23","port":0,"asn":16276,"as":"OVH SAS","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-30T11:07:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":7}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-26","alert":"Phishing Block","trigger":"mvkpop.es","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-08-23T23:05:01.76831Z","alert_count":0,"request_count":4,"received_data":372544,"sent_data":2060,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-23T22:23:59.870946Z","alert_count":0,"request_count":1,"received_data":17439,"sent_data":529,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"spy.mwork801.com","ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"domain_registered":"2026-02-25","domain_rank":0,"first_seen":"2026-08-04T05:36:05.278523Z","last_seen":"2026-08-26T10:11:31.827368Z","alert_count":33,"request_count":11,"received_data":880827,"sent_data":6314,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Bootstrap:5.3.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]}]},{"fqdn":"www.google.com","ip":{"addr":"142.251.155.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-08-23T22:53:46.029524Z","alert_count":0,"request_count":1,"received_data":6137,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ipapi.co","ip":{"addr":"104.26.8.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-08-20T02:37:52.187777Z","alert_count":0,"request_count":1,"received_data":2528,"sent_data":458,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-23T22:20:52.902616Z","alert_count":0,"request_count":1,"received_data":43948,"sent_data":570,"comment":"","tags":null,"fingerprints":null},{"fqdn":"mvkpop.es","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-26T10:11:31.134853Z","last_seen":"2026-08-26T10:11:31.134853Z","alert_count":10,"request_count":2,"received_data":2721,"sent_data":1022,"comment":"","tags":null,"fingerprints":[{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.251.143.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-08-24T08:39:13.43974Z","alert_count":0,"request_count":3,"received_data":271901,"sent_data":1463,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"mvkpop.es/fd6d5d61-9326-4621-a907-420fb67918bc#","fqdn":"mvkpop.es","domain":"mvkpop.es","tld":"es"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a5250c933201b3bbf3d825d4709b7450","sha1":"d8dc11344dbe96d5f70d6022084383a67a29c423","sha256":"cef3ed848b9f9df0516042f4b4c406cf854c7b5080829fa3559239e7ab11e5be","sha512":"102835de3d0b0de0fd65dac2f91d4230baf42976b10f1a55f4d87d18ac201011edaf2ba39743e7f0c422b6f7b1f0c472a18955241dcf2d74fb099c55a8a583cc","ssdeep":"","tlshash":"55f0222634631034196b558b223b9bd4b4f630133800dc8c318dd4d88f05f1bd0a7ead","size":502,"data":"","first_seen":"2026-07-21T00:19:19.744591Z","last_seen":"2026-08-26T11:07:41.152326Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e477967e482f32e65d4ea9b2fd8e106","sha1":"ddc6e9ead6d16ae9237399ce41e8c1620cc59c36","sha256":"0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c","sha512":"ecf8bfa2d7656db091f8b9d6f85ecfc057120c93ae5090773b1b441db838bd232fcef26375ee0fa35bf8051f4675cf5a5cd50d155518f922b9d70593f161741a","ssdeep":"1536:WmwIiEEO+TBR2t4J9RirWDKsVA5y7fy3YJtC/r/45wZbfbXZTb0WU078:HwORx3YCD45wZbDZTb0g8","tlshash":"ce73c5593244b4730ade85b68037430bf2265998b24b812cb57cadde2a7dcc67277f78","size":80721,"data":"","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-26T11:40:49.003556Z","times_seen":31347,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"f5ec46fa826947d0cd916101b86b2cc1","sha1":"27a2ec06268b8e46034b663eae514da9eb365952","sha256":"f518eea061c5a79dff39715dfb0ae6de427f85ac3fd855e827aff83b28947fce","sha512":"d003d9a169dd34138d1ac47d7d2f42b7649c4e1892e3a0aade9d1ef88f507586529e4621ede17f73b07ba5f8148d268d0889cc2329a6b29af0d5763bce953182","ssdeep":"","tlshash":"65c09b751c1040336c6504fc6515dab47d67373222716510e55cd174441cd6f54429e1","size":133,"data":"","first_seen":"2026-06-16T06:19:14.731548Z","last_seen":"2026-08-26T11:07:41.153189Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"060abc29a82860b80bc14b350dde7478","sha1":"406f7a4a8e7700c4cc2aa348692157c85d6c9f9a","sha256":"f5c6863f2f6cc390e86aa6a5dfd60298112a779a398895894aec8e79dd1f7f9f","sha512":"07fe699732ab738f5f1552410e9e981390cbbd97b6314b5ecb64ae9f3b5d75d85427df531ef29a9a01b235447ccafa126e0384fb7a2b2779ef2c8fc6bb5644bc","ssdeep":"","tlshash":"1dd02bdb8002916239f31086a3177344707300667840d083780c9a101b69f8fca5face","size":287,"data":"","first_seen":"2026-06-16T06:19:14.73258Z","last_seen":"2026-08-26T11:07:41.15407Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/intl-tel-input@18/build/js/intlTelInput.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e669525b552f1c01f67fc22d725b14ae","sha1":"745a50c5ec7e8af53349aee906755a194a7fc9b2","sha256":"f1a2d340dd4328bcf299da8143d4bc88b76ff400c1b2737ded165d24949b8990","sha512":"8ec68ea281bb960a158643f14fb20beaf24d3123cc6f5810aafa0e6be63046aa35a78d74c3b585e911706db2c12e315514684bd31eee2ec0611d0d8aa06acfac","ssdeep":"768:D3rXNC+I4SAGFdGc6HLZSV0Pu81yv4ppIsiCJmGR:jk3GcyyotfpIvCV","tlshash":"bcd2f8edb3552236a9ad9071647f12076ebf30015a84989d787ecdc81fdcec960b6b38","size":30824,"data":"","first_seen":"2024-12-07T20:42:42.6026Z","last_seen":"2026-08-26T11:07:41.142792Z","times_seen":155,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/main.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"90613bb6f5a9096ce18fe85049fc72e4","sha1":"1183c989da6c31a63bc5c160029131f20b9399b3","sha256":"dd05257b92433bb5555f446d2dcaa8f9d1fb0820b0bd93c0a94fe24a33bfd0f4","sha512":"7c6f5a332c26d504c28a348c6c569fc0c87ef68dfebad9fef48e28a307776f6bae5719d46f552629552c04d914027402888d72ac1da91a2dac4b6652d916408e","ssdeep":"768:8VeHFA6NmSNYLOFaLU8k4pW+VhQ5dhQ5hxhPSlDDLPZhyhKTBMGwKX833m:8MF1NmSNWUcQpQdhKlDDLP6hKTBMGwK7","tlshash":"6133c85ab2ec13b9e53704bd6e7f2c401ad8389faac9c40cf61d19d18f9ca95f82161d","size":53570,"data":"","first_seen":"2026-08-11T13:33:20.374967Z","last_seen":"2026-08-26T11:07:41.150557Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.143.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","size":89664,"data":"","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-26T11:07:41.130438Z","times_seen":34666,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/start.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"10c0a4ac06682a01ce1a34eb596cfa04","sha1":"3d31bc698a092bcbfff472c062e10dde6ba75aae","sha256":"4edda58e5b793fe38736a3869f9d30992728d12c0c4b3a048d74d99a1659c8e1","sha512":"96ac35ee10d80aa41125db6f9364d1bab96894bfe1f616c7fb79eafebd8f0e74dc7f6aef8d6651348ba27a46edffdc228a03df9a2b2f1bf845840a7f4cc3baf7","ssdeep":"","tlshash":"e761a8a735b71a3642eb20ae2b3b61087676000b3905ec5af95c8e40af50f79a5736cd","size":3280,"data":"","first_seen":"2026-07-27T18:34:00.274729Z","last_seen":"2026-08-26T11:07:41.131993Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.143.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mvkpop.es/workspace/voicem9303.html","date":"2026-08-26T11:07:10.665Z","timestamp":1787742430665,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:45 GMT","end":"Wed, 28 Oct 2026 20:43:44 GMT"},"fingerprint":{"sha1":"1E:50:A8:26:86:57:06:AF:03:D0:36:74:91:62:52:AE:87:D0:50:0C","sha256":"18:6F:33:F9:74:07:4C:C9:5D:94:38:03:B5:86:40:07:10:6F:E2:91:F9:CC:9C:DC:92:11:AA:41:F7:ED:5A:8E"}}},"request":{"raw":"GET /ajax/libs/jquery/3.6.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31100\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 25 Aug 2026 12:19:54 GMT\r\nexpires: Wed, 25 Aug 2027 12:19:54 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 82036\r\nlast-modified: Thu, 08 Sep 2022 18:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":89664,"size_decoded":32063,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-26T11:07:41.130438Z","times_seen":34666,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/start.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mvkpop.es/workspace/voicem9303.html","date":"2026-08-26T11:07:10.711Z","timestamp":1787742430711,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/js/start.js HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"cd0-19fefc08a96\"\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 3280\r\nDate: Wed, 26 Aug 2026 11:07:11 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":3280,"size_decoded":3635,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text","md5":"10c0a4ac06682a01ce1a34eb596cfa04","sha1":"3d31bc698a092bcbfff472c062e10dde6ba75aae","sha256":"4edda58e5b793fe38736a3869f9d30992728d12c0c4b3a048d74d99a1659c8e1","sha512":"96ac35ee10d80aa41125db6f9364d1bab96894bfe1f616c7fb79eafebd8f0e74dc7f6aef8d6651348ba27a46edffdc228a03df9a2b2f1bf845840a7f4cc3baf7","ssdeep":"","tlshash":"e761a8a735b71a3642eb20ae2b3b61087676000b3905ec5af95c8e40af50f79a5736cd","first_seen":"2026-07-27T18:34:00.274729Z","last_seen":"2026-08-26T11:07:41.131993Z","times_seen":18,"resource_available":true,"data":null}},"time_used":581,"timings":{"blocked":-1,"dns":180,"connect":131,"send":0,"wait":132,"receive":0,"ssl":137},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/favicon.ico","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.155.119","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mvkpop.es/workspace/voicem9303.html","date":"2026-08-26T11:07:10.825Z","timestamp":1787742430825,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:42:14 GMT","end":"Wed, 28 Oct 2026 20:42:13 GMT"},"fingerprint":{"sha1":"9E:E4:0B:D8:22:18:95:CA:F3:60:D0:A9:F5:51:6A:A9:AA:64:B5:C2","sha256":"04:A2:FD:09:AF:5F:A4:87:31:AC:C8:12:2A:13:F3:C5:AD:27:8F:5B:96:8F:50:1C:BA:45:10:A3:9D:C8:20:42"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 1494\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 26 Aug 2026 00:30:49 GMT\r\nexpires: Thu, 03 Sep 2026 00:30:49 GMT\r\ncache-control: public, max-age=691200\r\nlast-modified: Tue, 22 Oct 2019 18:30:00 GMT\r\ncontent-type: image/x-icon\r\nvary: Accept-Encoding\r\nage: 38181\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5430,"size_decoded":2201,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"f3418a443e7d841097c714d69ec4bcb8","sha1":"49263695f6b0cdd72f45cf1b775e660fdc36c606","sha256":"6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770","sha512":"82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563","ssdeep":"48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B","tlshash":"65b1b8b7e6c63030c85805bc49373a6d1e1b6ee31a9cf064fecc326a1a320d175256be","first_seen":"2023-04-05T04:39:39Z","last_seen":"2026-08-26T13:14:44.800327Z","times_seen":87470,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":0,"dns":16,"connect":24,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://mvkpop.es/workspace/voicem9303.html","date":"2026-08-26T11:07:12.147Z","timestamp":1787742432147,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1 HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"65f1-19fefc08a96\"\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 26097\r\nDate: Wed, 26 Aug 2026 11:07:12 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Bootstrap:5.3.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":26097,"size_decoded":26448,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (510)","md5":"0fc29ce20de165a5a3506b7abdce12de","sha1":"91703d8f7775f6b961d27de270ebef7acf259f77","sha256":"6194a33994e03e92876b6ea6f00bbc60c389e712e4b9122bce28d0d982dfd55a","sha512":"c3de91fef3f5667f84caa80291c744291689289db316fc79208b68335d76233b0e32c05c30a84f334b889ddac4a089c8f6392a4237191e09bdab74bea4f71efb","ssdeep":"384:l2k11lx1HxMncHM97Wj4qmHMNOUmHMVxWnMd27S:l2k11NxMcHMcs/HM8HMjWnM8S","tlshash":"4ec23d2061f0542351928090ba746e2f3e53e25bde0b4a5877fc0be16f8bde2dd6766c","first_seen":"2026-06-16T06:19:14.705396Z","last_seen":"2026-08-26T11:07:41.134567Z","times_seen":15,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":133,"receive":130,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/css/main.css","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.331Z","timestamp":1787742432331,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/css/main.css HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"1558-19fefc08a96\"\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 5464\r\nDate: Wed, 26 Aug 2026 11:07:12 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":5464,"size_decoded":5813,"mime_type":"text/css; charset=utf-8","magic":"assembler source, ASCII text","md5":"0bace82aa6e0e34904f1a9f2c0172f53","sha1":"9571a46b4aefcea9a8271e4e10b86d9c9ac9e24b","sha256":"27faa4c5bd4ea518b7826ecfec4476e231cbe9c7238bb847bf08918561e62b44","sha512":"a756ff45e84c7dbb590f3189e9dbe31558428ee7da4ec2d3e4d53ff70f6277842647ce68ed585ceb9d63aefb52d47fa1769de1e5047e7455d04a726569ec901c","ssdeep":"48:QO0dHZTkiW/gNjv+4J1vfJWYJj/QTQ5DJVK0C+F5TYqFcqjF0D/BkTDOuLW3RvvS:EHZkiUp4rrZos1rF5fFFFFQ3+cY2XY","tlshash":"d1b1e043a6b34f51381b516433ee92ab7b7961034a0ede683f8c32a08f413fa75527c8","first_seen":"2026-05-05T12:43:05.982908Z","last_seen":"2026-08-26T11:07:41.136307Z","times_seen":18,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":130,"send":0,"wait":134,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/signin_tapyes.gif","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.417Z","timestamp":1787742432417,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/signin_tapyes.gif HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"e9a5-19fefc08a96\"\r\nContent-Type: image/gif\r\nContent-Length: 59813\r\nDate: Wed, 26 Aug 2026 11:07:13 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":59813,"size_decoded":60149,"mime_type":"image/gif","magic":"GIF image data, version 89a, 511 x 451","md5":"749f60c166e318ba199cfaca226bc400","sha1":"1b4a13249246377ca3538092ad33add559becee2","sha256":"d95799234a097ba6fe72aec03dfeade73a35afeb458351f153487055c6e46d39","sha512":"3e8d66bbaf1e3ab77799281d3737731784482dad07c27ab457e0def3af09f139cc63178b79acc4f6ca0d4f0c85ca4ab8d4d4cf4ca0e93ae7d8cad1d5f9918102","ssdeep":"768:paL4wke8SCL6PmJAjANRaQ5VAYDEdLJ1QClZGJ7tyC7eWB/ji8x18cuxBOGUbqho:Ah8BL6fWXg91QCG5sC7c8P8cubVUeBAZ","tlshash":"57436a3fd32943a6d6061cb10f4d8e845afbed7844484f97887e516dad0d3ed2c668e2","first_seen":"2024-02-08T01:37:01Z","last_seen":"2026-08-26T11:07:41.137494Z","times_seen":537,"resource_available":false,"data":null}},"time_used":1096,"timings":{"blocked":959,"dns":0,"connect":135,"send":0,"wait":137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/st","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://mvkpop.es/workspace/voicem9303.html","date":"2026-08-26T11:07:11.314Z","timestamp":1787742431314,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"OPTIONS /st HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://mvkpop.es/\r\nOrigin: https://mvkpop.es\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 204 No Content\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary: Access-Control-Request-Headers\r\nAccess-Control-Allow-Headers: content-type\r\nContent-Length: 0\r\nDate: Wed, 26 Aug 2026 11:07:11 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":329,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-26T13:40:42.881751Z","times_seen":18114035,"resource_available":true,"data":null}},"time_used":398,"timings":{"blocked":0,"dns":0,"connect":131,"send":0,"wait":131,"receive":0,"ssl":136},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.325Z","timestamp":1787742432325,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 5.3.3\r\nx-jsd-version-type: version\r\netag: W/\"13b51-3cbp6tbRaukjc5nOQejBYgzFnDY\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Wed, 26 Aug 2026 11:07:12 GMT\r\nage: 1882164\r\nx-served-by: cache-fra-eddf8230066-FRA, cache-bma-essb1270076-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 24464\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80721,"size_decoded":25259,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"2e477967e482f32e65d4ea9b2fd8e106","sha1":"ddc6e9ead6d16ae9237399ce41e8c1620cc59c36","sha256":"0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c","sha512":"ecf8bfa2d7656db091f8b9d6f85ecfc057120c93ae5090773b1b441db838bd232fcef26375ee0fa35bf8051f4675cf5a5cd50d155518f922b9d70593f161741a","ssdeep":"1536:WmwIiEEO+TBR2t4J9RirWDKsVA5y7fy3YJtC/r/45wZbfbXZTb0WU078:HwORx3YCD45wZbDZTb0g8","tlshash":"ce73c5593244b4730ade85b68037430bf2265998b24b812cb57cadde2a7dcc67277f78","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-26T11:40:49.003556Z","times_seen":31347,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":3,"connect":9,"send":0,"wait":13,"receive":6,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/intl-tel-input@18/build/css/intlTelInput.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.335Z","timestamp":1787742432335,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/intl-tel-input@18/build/css/intlTelInput.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 18.5.3\r\nx-jsd-version-type: version\r\netag: W/\"620d-oNGsQ2ble3/C+/PqXqwezWw4bSc\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 29548\r\ndate: Wed, 26 Aug 2026 11:07:12 GMT\r\nx-served-by: cache-fra-eddf8230226-FRA, cache-bma-essb1270076-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 2935\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25101,"size_decoded":3697,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"14980f4e4ef578a6e70ec46c6a7c7d38","sha1":"a0d1ac4366e57b7fc2fbf3ea5eac1ecd6c386d27","sha256":"4be0304130ec3de2a5541df54e9e9f98c5f0abada1640b9ba4f46896cb575929","sha512":"e2932e00080fd310685628864f34adf5105ede87fe0559f34fd5ae1f66b86e61010b82794a51b63ff9c2484053c6d562ee940a541ceac26fbe8c34c7c9712f7c","ssdeep":"384:ZvImFjFg1M40/imOgs2J9ZE+xfmYqFD1+vSE8k2eOYcyMR:ZQmFjFg1M40FCFZ","tlshash":"c8b273674bb27914f92be1e1386006b2373b5c03f81e5b3d62e63dbd66810e0a4f3695","first_seen":"2024-08-19T19:01:39.489635Z","last_seen":"2026-08-26T11:07:41.140308Z","times_seen":81,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":9,"send":0,"wait":18,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/caution.png","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.342Z","timestamp":1787742432342,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/caution.png HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"26a6-19fefc08a96\"\r\nContent-Type: image/png\r\nContent-Length: 9894\r\nDate: Wed, 26 Aug 2026 11:07:13 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":9894,"size_decoded":10229,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"d5238c64724997f80f76a5a2ebbe7022","sha1":"763e31aa26572f09b10308600d0cd9875b797f97","sha256":"85428b402d6b33ab45ad8ff10ff6a966f88e49701c4ae3bd86e9784266b3cd3c","sha512":"6c33a2468582e3c5be49a81a5efb66ccfdaad1e1e09bb50f14eca4520728ec5a38eaac039b5882b061ef7907cf584fe198e90ef6ee04e7b10e1c06b92284948d","ssdeep":"192:nSDkxl4rzaTx874qlfU/+EC3m/AChGZ52AKxchb3K9YW6jlwRl3S:SDK63GcVl8/FC32ZCycVsZ4lwn3S","tlshash":"56129e5df6bde8aa449007de43b309f7d2485970c184fdfc58099de2ccaa64f209aad1","first_seen":"2024-04-10T06:17:36Z","last_seen":"2026-08-26T11:07:41.141182Z","times_seen":21,"resource_available":false,"data":null}},"time_used":1441,"timings":{"blocked":1036,"dns":0,"connect":136,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/account-recovery-sms-pin.gif","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.415Z","timestamp":1787742432415,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/account-recovery-sms-pin.gif HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"44cb6-19fefc08a96\"\r\nContent-Type: image/gif\r\nContent-Length: 281782\r\nDate: Wed, 26 Aug 2026 11:07:13 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":281782,"size_decoded":282120,"mime_type":"image/gif","magic":"GIF image data, version 89a, 209 x 170","md5":"f8ecb5d6d71cccada1198edca1bae221","sha1":"57597a278c67f185efed4cd3939e7f5375be3fc0","sha256":"428d97e19e91bd23dfcf73a96d0dd189c29a18a034373ecbfb2678d1524623f0","sha512":"8d09c2fe4a16c7344ae490efa12846f2c174f6e1a3e1b72c5950153b18346c52649cff9491f7709d6a4d4742f7d481074fd4a6db728b80ed4296c230e0cc8522","ssdeep":"6144:5hEQpYQof8AvKfwK4LGun0UzQvACWkkH1MEj4u:5hZoEPfwK9qNQfWkkVMnu","tlshash":"b4540269931f423c782b0dea5079afec32ced9f6535011634a7570f6aab42bc241c6b7","first_seen":"2024-09-19T10:14:43Z","last_seen":"2026-08-26T11:07:41.142004Z","times_seen":528,"resource_available":false,"data":null}},"time_used":1358,"timings":{"blocked":960,"dns":0,"connect":0,"send":0,"wait":137,"receive":261,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/intl-tel-input@18/build/js/intlTelInput.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.416Z","timestamp":1787742432416,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/intl-tel-input@18/build/js/intlTelInput.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 10572\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 18.5.3\r\nx-jsd-version-type: version\r\netag: W/\"7868-dFpQxex+ivUzSa7pBnVaGUp/ybI\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 35762\r\ndate: Wed, 26 Aug 2026 11:07:12 GMT\r\nx-served-by: cache-fra-eddf8230046-FRA, cache-bma-essb1270048-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30824,"size_decoded":11329,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27383)","md5":"e669525b552f1c01f67fc22d725b14ae","sha1":"745a50c5ec7e8af53349aee906755a194a7fc9b2","sha256":"f1a2d340dd4328bcf299da8143d4bc88b76ff400c1b2737ded165d24949b8990","sha512":"8ec68ea281bb960a158643f14fb20beaf24d3123cc6f5810aafa0e6be63046aa35a78d74c3b585e911706db2c12e315514684bd31eee2ec0611d0d8aa06acfac","ssdeep":"768:D3rXNC+I4SAGFdGc6HLZSV0Pu81yv4ppIsiCJmGR:jk3GcyyotfpIvCV","tlshash":"bcd2f8edb3552236a9ad9071647f12076ebf30015a84989d787ecdc81fdcec960b6b38","first_seen":"2024-12-07T20:42:42.6026Z","last_seen":"2026-08-26T11:07:41.142792Z","times_seen":155,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/arrowdown.png","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.419Z","timestamp":1787742432419,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/arrowdown.png HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"b7-19fefc08a96\"\r\nContent-Type: image/png\r\nContent-Length: 183\r\nDate: Wed, 26 Aug 2026 11:07:13 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":183,"size_decoded":515,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"1cdc1f147e49959815a2229280433923","sha1":"5141ff4bea5b5e557482ccb6c408840a1997368c","sha256":"bec61d00c4240e81fbee04980ae0ae8befdd9269b97cb9424b670ed5ff56d6c0","sha512":"c5db6b14b5fd5583b87d20a64ec122d9b6f699229e9dbde88fc05eba4c0056ff02cddf62fa0e4b10979b4ffeff83ca3acd43325d81c9a652ded94206fae7e12d","ssdeep":"","tlshash":"a2c0c0eb7e817c7fc0984752c15b8050a453225c052370d007710854311c5f01068733","first_seen":"2026-05-05T12:43:05.995386Z","last_seen":"2026-08-26T11:07:41.143568Z","times_seen":18,"resource_available":false,"data":null}},"time_used":1226,"timings":{"blocked":959,"dns":0,"connect":135,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.143.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mvkpop.es/workspace/voicem9303.html","date":"2026-08-26T11:07:10.490Z","timestamp":1787742430490,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:45 GMT","end":"Wed, 28 Oct 2026 20:43:44 GMT"},"fingerprint":{"sha1":"1E:50:A8:26:86:57:06:AF:03:D0:36:74:91:62:52:AE:87:D0:50:0C","sha256":"18:6F:33:F9:74:07:4C:C9:5D:94:38:03:B5:86:40:07:10:6F:E2:91:F9:CC:9C:DC:92:11:AA:41:F7:ED:5A:8E"}}},"request":{"raw":"GET /ajax/libs/jquery/3.6.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mvkpop.es/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31100\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 25 Aug 2026 12:19:54 GMT\r\nexpires: Wed, 25 Aug 2027 12:19:54 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 82036\r\nlast-modified: Thu, 08 Sep 2022 18:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":89664,"size_decoded":32083,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-26T11:07:41.130438Z","times_seen":34666,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":15,"connect":9,"send":0,"wait":11,"receive":12,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.143.138","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.321Z","timestamp":1787742432321,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:45 GMT","end":"Wed, 28 Oct 2026 20:43:44 GMT"},"fingerprint":{"sha1":"1E:50:A8:26:86:57:06:AF:03:D0:36:74:91:62:52:AE:87:D0:50:0C","sha256":"18:6F:33:F9:74:07:4C:C9:5D:94:38:03:B5:86:40:07:10:6F:E2:91:F9:CC:9C:DC:92:11:AA:41:F7:ED:5A:8E"}}},"request":{"raw":"GET /ajax/libs/jquery/3.6.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 31100\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 25 Aug 2026 12:19:54 GMT\r\nexpires: Wed, 25 Aug 2027 12:19:54 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 82038\r\nlast-modified: Thu, 08 Sep 2022 18:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":89664,"size_decoded":32063,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"00727d1d5d9c90f7de826f1a4a9cc632","sha1":"ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2","sha256":"a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74","sha512":"69528a4518bf43f615fb89a3a0a06c138c771fe0647a0a0cfde9b8e8d3650aa3539946000e305b78d79f371615ee0894a74571202b6a76b6ea53b89569e64d5c","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvg:SdeIygP3fulzcsz8jlvaDioQ47GKH","tlshash":"5393f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T01:28:27Z","last_seen":"2026-08-26T11:07:41.130438Z","times_seen":34666,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/css/load.css","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.328Z","timestamp":1787742432328,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/css/load.css HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"5beec-19fefc08a96\"\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 376556\r\nDate: Wed, 26 Aug 2026 11:07:12 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":376556,"size_decoded":376908,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (36751)","md5":"a48df3e18c59479b08ea9c2c5c411672","sha1":"f9723d48f39cb331f55a913a6aa125ed7304028c","sha256":"0dde3f4181697f7d70eead2e35e1dc3e2ac72283c646b7e82f1ebec68143d3c9","sha512":"0ceb9f41a85b4298b4aa56182a4c8935aa885053f56f4c3f93db1c61448d3bb0351a2b452df39668faefa7cbcfde0d8e1abb8a0bebe33f0b62cade4be324752f","ssdeep":"6144:x6CkjT5q3j6/8+Qq3j6/8+dq3j6/8+tq3j6/8+Iq3j6/8+Aq3j6/8+HQISNt1/bP:x6CkjTtKqSMT","tlshash":"43841ddf9231b07ff932a4b5d9c0ae49f2c989c0f65b4576bc70ba1741ab6a61391330","first_seen":"2026-02-13T13:38:22.7519Z","last_seen":"2026-08-26T11:07:41.144443Z","times_seen":20,"resource_available":false,"data":null}},"time_used":1050,"timings":{"blocked":-1,"dns":0,"connect":130,"send":0,"wait":262,"receive":522,"ssl":135},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Roboto:wght@300;400;500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.334Z","timestamp":1787742432334,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css2?family=Roboto:wght@300;400;500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Wed, 26 Aug 2026 11:07:12 GMT\r\ndate: Wed, 26 Aug 2026 11:07:12 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16755,"size_decoded":2367,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"110e0aca6ca30b48bfdcc77c30eeb6bf","sha1":"21ee214ed15b2a4e80a4dc7131fa3fff5c141e9f","sha256":"0e02306b564f44631f56bcb6470cc16776743354779ebe283caf45ef7b447073","sha512":"38b6b3ecce638611cdf1aeb23ac77dda220a4d3a4c4a76119bc0c7a10427c4b984398ea785d0d003c9174b33da66388c786fed2ecff7421b26a4f799f8dff71f","ssdeep":"384:p9f59g9P9r9yU9/qY4+949Y9p9fM919W969yh9/qY4X9N9t9i9fD9O9d9B9ya9/E:pDS99YURRuWDyjooYhREHPM5svvYaR78","tlshash":"307210a1041744009b834ce223cebf35fe1f52117142d0b5abfd9b6b9ddbca6526939d","first_seen":"2026-02-20T02:54:07.842809Z","last_seen":"2026-08-26T11:07:41.145311Z","times_seen":1478,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":2,"connect":18,"send":0,"wait":38,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/img/favico.png","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.340Z","timestamp":1787742432340,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/img/favico.png HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"ec00-19fefc08a96\"\r\nContent-Type: image/png\r\nContent-Length: 60416\r\nDate: Wed, 26 Aug 2026 11:07:13 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":60416,"size_decoded":60752,"mime_type":"image/png","magic":"PNG image data, 2084 x 2084, 8-bit/color RGBA, non-interlaced","md5":"2283a397277610f3965d1a3a3d8d8417","sha1":"2b8bcc5004eddb9f5932c99979849c15e8192ffc","sha256":"e4722fe7a85e003c53066827ecccf5139439c6de9cf6cee7e359dd1ce5bd9a51","sha512":"83d512cd82e330d37647716fa5fcb24189bf1522c6ddfbcad8b6357a49ab005c4c8547d98d992ff191adec898cdc23ba994769a44227e410472d243a8f02eb33","ssdeep":"1536:ftNzNaKiSC5cI4moYvvB+2uWtmJBDjAzZM3+HDL:fthMKLf++W4PIzZMujL","tlshash":"c34349bb20066d94c4a969ba588896dcfb365db88a97274f407167beccfd7d42cc0c43","first_seen":"2024-04-10T06:17:36Z","last_seen":"2026-08-26T11:07:41.146565Z","times_seen":21,"resource_available":false,"data":null}},"time_used":1172,"timings":{"blocked":1036,"dns":0,"connect":0,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.8.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:13.425Z","timestamp":1787742433425,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://spy.mwork801.com/\r\nOrigin: https://spy.mwork801.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 26 Aug 2026 11:07:13 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: POST, OPTIONS, HEAD, OPTIONS, GET\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://spy.mwork801.com\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DCsiZkReVJMvF1s6gKcdclTCLYRswNGlQEWi2EA1Qyn%2F59vYBHsF76qUb1MSkPx0H2UOYOnHYrI%2FyRHSTf0LYx9SF7rfw2Os2C2QOWYDwxTyDTE69CVqcIKU\"}]}\r\ncontent-encoding: br\r\ncf-ray: a3125f210bfba0f0-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2139,"mime_type":"application/json","magic":"JSON text data","md5":"c9a83cf7b79bb169afa15370aaa9d642","sha1":"e0fb50e54473bf4468fe35add9fd6f777c8633dc","sha256":"9513f5d1cb329721ac415720ce53669e0e98329f191ef9bacb323dd35b4134c1","sha512":"b937a919074c16e74b79086e2d1037911cd8578d04669f9bb90914c0cf579bf200fee329b8282a3c700eddfe26dbe73407141bd88a949e219f394fdc0d672e41","ssdeep":"","tlshash":"5a01df68e4780f7b9cb813587078691b113422176e563a8e7bd4a74d0f8d8bf30b135e","first_seen":"2026-08-17T05:59:44.876786Z","last_seen":"2026-08-26T11:07:41.147409Z","times_seen":344,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":0,"dns":3,"connect":1,"send":0,"wait":262,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.251.38.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:13.443Z","timestamp":1787742433443,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:45 GMT","end":"Wed, 28 Oct 2026 20:43:44 GMT"},"fingerprint":{"sha1":"B7:46:09:45:08:65:39:24:A9:15:3D:36:1B:A8:14:83:15:F8:BC:DE","sha256":"CC:52:63:08:35:24:92:7E:29:4C:2A:B7:08:DD:91:33:FE:34:AD:9D:58:2B:79:7B:5E:AD:4D:7C:C9:3D:9E:6C"}}},"request":{"raw":"GET /s/roboto/v51/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://spy.mwork801.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 43136\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Tue, 25 Aug 2026 11:31:35 GMT\r\nexpires: Wed, 25 Aug 2027 11:31:35 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 18 Feb 2026 19:51:37 GMT\r\ncontent-type: font/woff2\r\nage: 84938\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43136,"size_decoded":43948,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 43136, version 1.0","md5":"665db5e157d2138835c4037c971ff3a4","sha1":"41ca6b7e4818eb81531d8006ff7ddd971c640879","sha256":"1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc","sha512":"6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a","ssdeep":"768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW","tlshash":"f9130231eb70ee59962c903454e7fda9433b1457d731aca80e99a1ce6f8103454facec","first_seen":"2026-02-19T22:27:43.350598Z","last_seen":"2026-08-26T13:43:03.353585Z","times_seen":273831,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":0,"dns":13,"connect":23,"send":0,"wait":9,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mvkpop.es/favicon.ico","fqdn":"mvkpop.es","domain":"mvkpop.es","tld":"es"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mvkpop.es/workspace/voicem9303.html","date":"2026-08-26T11:07:10.640Z","timestamp":1787742430640,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mvkpop.es","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 16:53:28 GMT","end":"Sat, 10 Oct 2026 16:53:27 GMT"},"fingerprint":{"sha1":"43:05:49:41:B3:1E:1C:87:BF:29:D2:43:88:75:22:5F:A3:AF:FB:44","sha256":"AE:1C:53:0F:2C:CC:64:15:29:31:43:AE:88:2D:ED:FE:FB:F5:66:77:1F:8B:1D:76:C8:42:36:20:0C:BC:89:DF"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: mvkpop.es\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mvkpop.es/workspace/voicem9303.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-26T13:40:42.881751Z","times_seen":18114035,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-26","alert":"Phishing Block","trigger":"mvkpop.es","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.65.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.332Z","timestamp":1787742432332,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap@5.3.3/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 5.3.3\r\nx-jsd-version-type: version\r\netag: W/\"38d63-xawd7pYctZoEUlbsID9p4xeHL3w\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Wed, 26 Aug 2026 11:07:12 GMT\r\nage: 1888511\r\nx-served-by: cache-fra-eddf8230218-FRA, cache-bma-essb1270076-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 33206\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232803,"size_decoded":33987,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65342)","md5":"a549af2a81cd9900ee897d8bc9c4b5e9","sha1":"c5ac1dee961cb59a045256ec203f69e317872f7c","sha256":"3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8","sha512":"8e74ae0384acd8f9248a448e2ed62cf0195821e7882b587df6dcb861fbd13c0973af7efbbebdc25c36fbb1bede1040588c3b5c623f808c11f714bbf9b9226e5e","ssdeep":"1536:O9YnIWbn98fdRfvO5wlP77k9P3EV98IsYRElV6V6pz600I41r:RnIw98fbV986I6V6pz600I41r","tlshash":"dc3482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2024-02-25T11:27:02Z","last_seen":"2026-08-26T11:40:49.019353Z","times_seen":26766,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":9,"send":0,"wait":9,"receive":4,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"spy.mwork801.com/gmail/js/main.js","fqdn":"spy.mwork801.com","domain":"mwork801.com","tld":"com"},"ip":{"addr":"5.231.63.6","port":443,"asn":44477,"as":"Stark Industries Solutions Ltd","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1#","date":"2026-08-26T11:07:12.420Z","timestamp":1787742432420,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"spy.mwork801.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 08 Jul 2026 15:44:43 GMT","end":"Tue, 06 Oct 2026 15:44:42 GMT"},"fingerprint":{"sha1":"81:6F:25:04:70:00:12:F4:39:F3:5A:07:E4:7D:A6:32:4D:81:22:04","sha256":"CA:42:4E:10:1B:75:52:86:8F:04:D1:4F:AC:39:DA:FC:31:E7:37:8D:AF:B0:8D:E0:2A:A5:94:C6:D6:93:0B:40"}}},"request":{"raw":"GET /gmail/js/main.js HTTP/1.1\r\nHost: spy.mwork801.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://spy.mwork801.com/gmail-login?sid=980333326204605080930277924384\u0026cid=null\u0026warning=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccept-Ranges: bytes\r\nCache-Control: public, max-age=0\r\nLast-Modified: Tue, 11 Aug 2026 07:36:40 GMT\r\nETag: W/\"d144-19fefc08a96\"\r\nContent-Type: text/javascript; charset=utf-8\r\nContent-Length: 53572\r\nDate: Wed, 26 Aug 2026 11:07:12 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":53572,"size_decoded":53929,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (29007)","md5":"90613bb6f5a9096ce18fe85049fc72e4","sha1":"1183c989da6c31a63bc5c160029131f20b9399b3","sha256":"dd05257b92433bb5555f446d2dcaa8f9d1fb0820b0bd93c0a94fe24a33bfd0f4","sha512":"7c6f5a332c26d504c28a348c6c569fc0c87ef68dfebad9fef48e28a307776f6bae5719d46f552629552c04d914027402888d72ac1da91a2dac4b6652d916408e","ssdeep":"768:8VeHFA6NmSNYLOFaLU8k4pW+VhQ5dhQ5hxhPSlDDLPZhyhKTBMGwKX833m:8MF1NmSNWUcQpQdhKlDDLP6hKTBMGwK7","tlshash":"6133c85ab2ec13b9e53704bd6e7f2c401ad8389faac9c40cf61d19d18f9ca95f82161d","first_seen":"2026-08-11T13:33:20.374967Z","last_seen":"2026-08-26T11:07:41.150557Z","times_seen":4,"resource_available":true,"data":null}},"time_used":567,"timings":{"blocked":175,"dns":0,"connect":0,"send":0,"wait":262,"receive":130,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"spy.mwork801.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mvkpop.es/workspace/voicem9303.html","fqdn":"mvkpop.es","domain":"mvkpop.es","tld":"es"},"ip":{"addr":"15.204.131.23","port":443,"asn":16276,"as":"OVH SAS","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-26T11:07:09.563Z","timestamp":1787742429563,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mvkpop.es","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 16:53:28 GMT","end":"Sat, 10 Oct 2026 16:53:27 GMT"},"fingerprint":{"sha1":"43:05:49:41:B3:1E:1C:87:BF:29:D2:43:88:75:22:5F:A3:AF:FB:44","sha256":"AE:1C:53:0F:2C:CC:64:15:29:31:43:AE:88:2D:ED:FE:FB:F5:66:77:1F:8B:1D:76:C8:42:36:20:0C:BC:89:DF"}}},"request":{"raw":"GET /workspace/voicem9303.html HTTP/1.1\r\nHost: mvkpop.es\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\nlast-modified: Tue, 18 Aug 2026 20:45:52 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 800\r\ndate: Wed, 26 Aug 2026 11:07:10 GMT\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":2312,"size_decoded":1209,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"a625b9f87a6f875d87ef0f9b4c9de302","sha1":"7abe5995603e32e5982a08d807f6825699e04836","sha256":"8ce1a1fafe779099e02a349fdad52a9353148e06e8cf570d27b8605f80838e62","sha512":"742d1f78bcde83741d3e24de23310d163048bab883dcedd4f1fc0108e0c3d3d979e45b10f4d78559c4e17b43040023e1aca53945dd48349d134e72ea1847e2a0","ssdeep":"","tlshash":"c441519668808c29167181a26ba3b24ce97371473b80ce8d35cc912b4f75b59cce3adc","first_seen":"2026-08-04T05:36:12.307616Z","last_seen":"2026-08-26T11:07:41.151464Z","times_seen":6,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":117,"connect":104,"send":0,"wait":105,"receive":0,"ssl":211},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-26","alert":"Phishing Block","trigger":"mvkpop.es","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-26","alert":"Sinkholed","trigger":"mvkpop.es","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}}]}