{"report_id":"eb7046b5-6e59-4bbd-a4d3-55c4b227bd96","version":6,"status":"done","tags":[],"date":"2026-02-23T14:10:31Z","url":{"schema":"http","addr":"appealportal-x.click","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"104.21.18.253","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"http","addr":"appealportal-x.click/","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"title":"appealportal-x.click | Domain Parked","dom":{"size":11687,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1109)","md5":"7dbc7a4efd9c4dcd0ffceecb4e18945e","sha1":"3bae5123894ffd88ea7d04fdcb00dcd8a41f8ab0","sha256":"122a5be0e183a5da7e349f7023e443d7e1795047edbbad3e98afb482eaedd72e","sha512":"52102160f15c1e012de23a21880144e5a34e8d874038e344d3e3a0d3a75448eb30b1cb014da8f8e35f713610b8d69f650cb14068187abb116d83098b75990383","ssdeep":"192:BqJATJfcQhDbXc/bXcoxsqcj9akLVnzqi5fZJCY3IZF/Hh37EK//Jf8bYbXc9bXe:kJiJfbSQVLguqkfZkiIZF1nJf8bFKAuT","tlshash":"6032c5be46f4906921d2c38d6f61b2487b9df06bb1618440bb9f06da0f82d93dc37918","dom_hash":"domhashc2f4502c1454d80bc3b704fcee76bbc3","first_seen":"2026-02-23T14:10:35.835035Z","last_seen":"2026-02-23T14:10:35.835035Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"appealportal-x.click","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"104.21.18.253","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-30T14:10:31Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":5,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.624481+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":793},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":677,\"bytes_toclient\":5142,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.862260+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/assets/css/style.css?v=524913\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/css\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":727},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":10,\"pkts_toclient\":10,\"bytes_toserver\":1449,\"bytes_toclient\":7676,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:09Z","timestamp":1771855809,"ip_dst":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":39702,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:09.029092+0000\",\"flow_id\":612519777457204,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":39702,\"dest_ip\":\"188.114.97.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/assets/img/atakdomain-logo.webp\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/webp\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":774},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":657,\"bytes_toclient\":7710,\"start\":\"2026-02-23T14:10:08.709684+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:09Z","timestamp":1771855809,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:09.209954+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":2,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":404,\"length\":682},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":13,\"pkts_toclient\":13,\"bytes_toserver\":2012,\"bytes_toclient\":9183,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:09Z","timestamp":1771855809,"ip_dst":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":39702,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:09.515503+0000\",\"flow_id\":612519777457204,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":39702,\"dest_ip\":\"188.114.97.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/assets/img/bg-9.jpg\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/jpeg\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":769},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":46,\"pkts_toclient\":62,\"bytes_toserver\":3802,\"bytes_toclient\":85166,\"start\":\"2026-02-23T14:10:08.709684+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"cdn.atakdomain.com","ip":{"addr":"172.66.41.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2006-03-30","domain_rank":0,"first_seen":"2019-10-23T11:34:39Z","last_seen":"2026-02-18T20:24:03.677415Z","alert_count":0,"request_count":4,"received_data":298900,"sent_data":1830,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"appealportal-x.click","ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-08-02","domain_rank":0,"first_seen":"2026-02-23T14:10:31.596888Z","last_seen":"2026-02-23T14:10:31.596888Z","alert_count":6,"request_count":6,"received_data":400728,"sent_data":2393,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"appealportal-x.click/","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"aa6881f72c0db7b0d31ec3a5a6176ad2","sha1":"8fe50ee9de104d87b88ee00a0b009ca75542febf","sha256":"5d1b8f47c39eb17be85b317cd7cec7d71c7633d8755bae6a83e7276bbdb6172d","sha512":"1d4b723b9a03354a1adbaa99f7198c9b69207aba034effeb764054dfbf17db54e65b82e575bb057cd22098ea97a76b86d097e1c2f5d4da0fbbe8d790c72c9fd7","ssdeep":"","tlshash":"e0f0f43eac95512026f7c74d3fb6b3543954f6db91f0800eba4f5aca0f16209ac79a1e","size":654,"data":"","first_seen":"2025-03-27T02:53:07.115141Z","last_seen":"2026-06-06T20:20:24.725067Z","times_seen":301,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.624481+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":793},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":677,\"bytes_toclient\":5142,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.atakdomain.com/styles/plugins/jquery/jquery-3.3.1.min.js","fqdn":"cdn.atakdomain.com","domain":"atakdomain.com","tld":"com"},"ip":{"addr":"172.66.41.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"378087a64e1394fc51f300bb9c11878c","sha1":"0c3192b500a4fd550e483cf77a49806a5872185b","sha256":"4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de","sha512":"9a2c70516ea0c8c37c7f072f214de0afd5ddeb643c6b5d3fa8ade3ef8d2ce40bdf8b1b1194bad296e9075562701ee7dae48b18144b1cd2d735328be5a3accbe6","ssdeep":"1536:aLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6ta:+kn6x2xe9NK6nC6E","tlshash":"208319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","size":86929,"data":"","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-08-20T04:22:17.113435Z","times_seen":5864,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"appealportal-x.click/","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"8323c496aaec74aab4c4343241fe92e2","sha1":"3ca84e6c35e482d4b344e3013b1bde6ba5aee58a","sha256":"f71de3b703f95631b064303238a6afeb565b8b4a1b2a80a461d7b98b6fd2cfa4","sha512":"9967252e1c88415b27def4f82669a3c9d80065c454ea756a6c98d00f521b44aaac45c0db1b5fd2ce99bdbf85bb708a1862ed14eba8e6658333fbce6239c10ab7","ssdeep":"","tlshash":"3911cb2eddaa442035f7d74e3f6272813958f1ab8054cd09b84d5ac50f062299d3a6af","size":1060,"data":"","first_seen":"2025-03-27T02:53:07.116158Z","last_seen":"2026-06-06T20:20:24.725583Z","times_seen":301,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.624481+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":793},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":677,\"bytes_toclient\":5142,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.atakdomain.com/styles/plugins/jquery/jquery-3.3.1.min.js","fqdn":"cdn.atakdomain.com","domain":"atakdomain.com","tld":"com"},"ip":{"addr":"172.66.41.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"378087a64e1394fc51f300bb9c11878c","sha1":"0c3192b500a4fd550e483cf77a49806a5872185b","sha256":"4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de","sha512":"9a2c70516ea0c8c37c7f072f214de0afd5ddeb643c6b5d3fa8ade3ef8d2ce40bdf8b1b1194bad296e9075562701ee7dae48b18144b1cd2d735328be5a3accbe6","ssdeep":"1536:aLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6ta:+kn6x2xe9NK6nC6E","tlshash":"208319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","size":86929,"data":"","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-08-20T04:22:17.113435Z","times_seen":5864,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"appealportal-x.click/","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"e0a51787d1239cd70091ad24785a099f","sha1":"a085b042526f8622dd25ac3014d1f9e0a2323723","sha256":"8c4240ca1b8b61474cbb03c20d535491f615e3e04b303029b85d7ee27a0cbb10","sha512":"33acb0ba309228b4e81ecfda51c8d77029c6d7de321244ff8c1795a0506dd3f112c8119dddcbfaf44742ab6e9c13b207716a143972fb0a8ee2f227208602e097","ssdeep":"","tlshash":"0711024de07624181113a19676872684bcfb581366335d4afb0f510b1fc396569224dd","size":1024,"data":"","first_seen":"2025-03-27T02:53:07.117176Z","last_seen":"2026-06-06T20:20:24.726043Z","times_seen":301,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.624481+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":793},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":677,\"bytes_toclient\":5142,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"}],"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cdn.atakdomain.com/styles/plugins/jquery/jquery-3.3.1.min.js","fqdn":"cdn.atakdomain.com","domain":"atakdomain.com","tld":"com"},"ip":{"addr":"172.66.41.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:08.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atakdomain.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 03:49:31 GMT","end":"Tue, 31 Mar 2026 04:49:15 GMT"},"fingerprint":{"sha1":"D8:11:1F:56:E6:21:D8:46:F0:DC:86:38:42:62:9C:07:E8:0F:AA:AF","sha256":"90:48:A9:28:5E:AC:85:97:34:50:F5:7D:05:C7:F2:0D:98:3E:DF:BD:72:53:84:24:F1:19:2B:28:22:F3:C8:56"}}},"request":{"raw":"GET /styles/plugins/jquery/jquery-3.3.1.min.js HTTP/1.1\r\nHost: cdn.atakdomain.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 23 Feb 2026 14:10:08 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 04 Nov 2024 08:05:09 GMT\r\netag: W/\"6ea19444902edb1:0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept\r\nx-frame-options: SAMEORIGIN\r\nexpires: Tue, 23 Feb 2027 14:10:08 GMT\r\nx-cache-status: HIT\r\nx-cdn-forward: idecdn\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 428\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nx-xss-protection: 1; mode=block\r\ncf-ray: 9d274e14da168deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":86929,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65450), with CRLF line terminators","md5":"378087a64e1394fc51f300bb9c11878c","sha1":"0c3192b500a4fd550e483cf77a49806a5872185b","sha256":"4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de","sha512":"9a2c70516ea0c8c37c7f072f214de0afd5ddeb643c6b5d3fa8ade3ef8d2ce40bdf8b1b1194bad296e9075562701ee7dae48b18144b1cd2d735328be5a3accbe6","ssdeep":"1536:aLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6ta:+kn6x2xe9NK6nC6E","tlshash":"208319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-08-20T04:22:17.113435Z","times_seen":5864,"resource_available":true,"data":null}},"time_used":154,"timings":{"blocked":67,"dns":35,"connect":8,"send":0,"wait":15,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.atakdomain.com/styles/images/blank.gif","fqdn":"cdn.atakdomain.com","domain":"atakdomain.com","tld":"com"},"ip":{"addr":"172.66.41.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:08.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atakdomain.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 03:49:31 GMT","end":"Tue, 31 Mar 2026 04:49:15 GMT"},"fingerprint":{"sha1":"D8:11:1F:56:E6:21:D8:46:F0:DC:86:38:42:62:9C:07:E8:0F:AA:AF","sha256":"90:48:A9:28:5E:AC:85:97:34:50:F5:7D:05:C7:F2:0D:98:3E:DF:BD:72:53:84:24:F1:19:2B:28:22:F3:C8:56"}}},"request":{"raw":"GET /styles/images/blank.gif HTTP/1.1\r\nHost: cdn.atakdomain.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 23 Feb 2026 14:10:08 GMT\r\ncontent-type: image/webp\r\ncontent-length: 34\r\nserver: cloudflare\r\ncache-control: public, max-age=31536000\r\ncf-bgj: imgq:85,h2pri\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncf-polished: origFmt=gif, origSize=46\r\ncontent-disposition: inline; filename=\"blank.webp\"\r\nvary: accept\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\netag: \"f5ddb542902edb1:0\"\r\nlast-modified: Mon, 04 Nov 2024 08:05:06 GMT\r\nx-cache-status: HIT\r\nx-cdn-forward: idecdn\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nage: 607377\r\nexpires: Tue, 23 Feb 2027 14:10:08 GMT\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nx-xss-protection: 1; mode=block\r\ncf-ray: 9d274e14c9c58deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":34,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cda661faf5e60e281e5f56067e7909db","sha1":"324a0323af79f3142387d4761198f9ace2d78b3d","sha256":"86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65","sha512":"0aafb51004529f0c0bce5edf61235ba8da9eddc9be7e7395647bc307049fe820f20848bbb9b4e4370440eadfc70bf6d0412af95db230d4c54999c22d5b85e8c5","ssdeep":"","tlshash":"5780041c437044054d151c1f115007d1c01500041041c5c11451045d0750714333453d","first_seen":"2023-04-07T00:29:15Z","last_seen":"2026-08-19T20:55:37.169006Z","times_seen":4005,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":56,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.atakdomain.com/styles/plugins/jquery/jquery-3.3.1.min.js","fqdn":"cdn.atakdomain.com","domain":"atakdomain.com","tld":"com"},"ip":{"addr":"172.66.41.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:08.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atakdomain.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 03:49:31 GMT","end":"Tue, 31 Mar 2026 04:49:15 GMT"},"fingerprint":{"sha1":"D8:11:1F:56:E6:21:D8:46:F0:DC:86:38:42:62:9C:07:E8:0F:AA:AF","sha256":"90:48:A9:28:5E:AC:85:97:34:50:F5:7D:05:C7:F2:0D:98:3E:DF:BD:72:53:84:24:F1:19:2B:28:22:F3:C8:56"}}},"request":{"raw":"GET /styles/plugins/jquery/jquery-3.3.1.min.js HTTP/1.1\r\nHost: cdn.atakdomain.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Mon, 23 Feb 2026 14:10:08 GMT\r\ncontent-type: application/javascript\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 04 Nov 2024 08:05:09 GMT\r\netag: W/\"6ea19444902edb1:0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept\r\nx-frame-options: SAMEORIGIN\r\nexpires: Tue, 23 Feb 2027 14:10:08 GMT\r\nx-cache-status: HIT\r\nx-cdn-forward: idecdn\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 428\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nx-xss-protection: 1; mode=block\r\ncf-ray: 9d274e15b8dbdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":86929,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65450), with CRLF line terminators","md5":"378087a64e1394fc51f300bb9c11878c","sha1":"0c3192b500a4fd550e483cf77a49806a5872185b","sha256":"4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de","sha512":"9a2c70516ea0c8c37c7f072f214de0afd5ddeb643c6b5d3fa8ade3ef8d2ce40bdf8b1b1194bad296e9075562701ee7dae48b18144b1cd2d735328be5a3accbe6","ssdeep":"1536:aLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6ta:+kn6x2xe9NK6nC6E","tlshash":"208319dd72c6b06247ab71ba00bf550bf2361999684d4410f129e4eabc74b4e823bf7d","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-08-20T04:22:17.113435Z","times_seen":5864,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":16,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"appealportal-x.click/favicon.ico","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:09.060Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: appealportal-x.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Mon, 23 Feb 2026 14:10:09 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: cloudflare\r\nX-Powered-By: ASP.NET\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dyyUMRg%2BQHRjJ%2BHS0HdZFQf5SFDFB%2BWXkZ%2F0zbzk40FNTVOTvYbwp73OQcwbfqvOGQtlnd31sGjqs2dEo2GKSYcXyhGdVtrf9XLKTL5F0jkhKeZ%2B\"}]}\r\nContent-Encoding: gzip\r\nCF-RAY: 9d274e16af1e1806-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1245,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"5343c1a8b203c162a3bf3870d9f50fd4","sha1":"04b5b886c20d88b57eea6d8ff882624a4ac1e51d","sha256":"dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f","sha512":"e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949","ssdeep":"","tlshash":"7b21422992983814f69384a061f277c23f078286e66f1b68a023b263e4c26e281d33c4","first_seen":"2023-03-09T23:36:42Z","last_seen":"2026-08-20T05:29:16.287285Z","times_seen":63965,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:09Z","timestamp":1771855809,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:09.209954+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":2,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/favicon.ico\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":404,\"length\":682},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":13,\"pkts_toclient\":13,\"bytes_toserver\":2012,\"bytes_toclient\":9183,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"appealportal-x.click/","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-23T14:10:07.981Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"appealportal-x.click","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 28 Jan 2026 23:10:01 GMT","end":"Wed, 29 Apr 2026 00:07:44 GMT"},"fingerprint":{"sha1":"AD:35:CD:19:4E:5A:33:E7:C7:8F:AB:FC:38:4A:D7:C8:38:28:0A:20","sha256":"62:85:B3:DC:F1:19:13:89:5A:A6:D1:75:0A:07:83:E9:E8:5E:20:CA:EF:A5:56:A7:55:93:42:28:02:40:A5:75"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: appealportal-x.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Mon, 23 Feb 2026 14:10:08 GMT\r\ncontent-type: text/html; charset=us-ascii\r\nserver: cloudflare\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WVjSMW%2FNDpHs1MUR%2Flff4zb7Z2c5n6GOXRFxgXzLp57ztZpEd7CHuvFIhq8zEzimZ6AEDn0wHJk%2FCkms1qcleCT91AU7IyEOPVPI2XNd2rVjFlli\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9d274e107a33dd16-ARN\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":315,"size_decoded":0,"mime_type":"text/html; charset=us-ascii","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"67932d4b695e1d6b19dfc2e3610761ff","sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","sha512":"97408b30995b72417494daca4c67488b77e3121a9db8bb3c2f204b49944457caa1af4b75730511b39fc9babcca5e1440168c3dbf3377b072866295bd490710fe","ssdeep":"","tlshash":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","first_seen":"2023-04-05T14:02:50Z","last_seen":"2026-08-20T04:31:51.485654Z","times_seen":2500,"resource_available":true,"data":null}},"time_used":490,"timings":{"blocked":95,"dns":70,"connect":8,"send":0,"wait":289,"receive":0,"ssl":26},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.624481+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":793},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":677,\"bytes_toclient\":5142,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"appealportal-x.click/","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-23T14:10:08.448Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: appealportal-x.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 23 Feb 2026 14:10:08 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gTYxUpmb%2BBMd%2FHDPnCFWBZhoeZiwgBWF3hW1FdlUQ47vhqAiMunYx8fGV8sk%2BrQw5To4zQc4zJ2YirT3W0xpURbJC5NEXQIT8KyDS0npqGbm%2FE9S\"}]}\r\nLast-Modified: Tue, 10 Dec 2024 15:18:04 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nX-Powered-By: ASP.NET\r\ncf-cache-status: DYNAMIC\r\nContent-Encoding: gzip\r\nCF-RAY: 9d274e12dcce1806-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":11712,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1104), with CRLF line terminators","md5":"e40178ce88477d6c84f247b7f728814a","sha1":"9dc7b9762d486ca1328de84eca0e982b931ef59f","sha256":"a9cf6d1a3faaff15905bfe1edd7571694233760a1debb92e013c7377a2fbe4e5","sha512":"72ea88450c7fa5cecb54c22556c298ccd12f6c498355da5ecf1143a0aac6fa2c416b6e201448fea434e937ca9d3dd6a21d54637a3816694e9b57a58a84eb38f3","ssdeep":"192:fR5JHXJfDM9bXcFbXcM3Wncj9akLVtzqt5fZJCY3nXF7Hh37EKBHJfWjbXcTbXcZ:fPJ3Jf4KSMmcgYqLfZkinXFZdJfWUkxj","tlshash":"bb32b7be46a4506921f2c38c6f60b288fb9ef067b1618540bb9f16d70fb2d52dc73958","first_seen":"2025-04-08T10:01:35.546123Z","last_seen":"2026-07-20T23:26:03.319871Z","times_seen":310,"resource_available":true,"data":null}},"time_used":185,"timings":{"blocked":7,"dns":1,"connect":8,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.624481+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":793},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":677,\"bytes_toclient\":5142,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.atakdomain.com/styles/plugins/bootstrap/css/bootstrap.min.css","fqdn":"cdn.atakdomain.com","domain":"atakdomain.com","tld":"com"},"ip":{"addr":"172.66.41.19","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:08.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"atakdomain.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 31 Dec 2025 03:49:31 GMT","end":"Tue, 31 Mar 2026 04:49:15 GMT"},"fingerprint":{"sha1":"D8:11:1F:56:E6:21:D8:46:F0:DC:86:38:42:62:9C:07:E8:0F:AA:AF","sha256":"90:48:A9:28:5E:AC:85:97:34:50:F5:7D:05:C7:F2:0D:98:3E:DF:BD:72:53:84:24:F1:19:2B:28:22:F3:C8:56"}}},"request":{"raw":"GET /styles/plugins/bootstrap/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.atakdomain.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 23 Feb 2026 14:10:08 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 04 Nov 2024 08:05:09 GMT\r\netag: W/\"9ebb7e44902edb1:0\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept\r\nx-frame-options: SAMEORIGIN\r\nexpires: Tue, 23 Feb 2027 14:10:08 GMT\r\nx-cache-status: HIT\r\nx-cdn-forward: idecdn\r\ncontent-encoding: gzip\r\ncf-cache-status: HIT\r\nage: 428\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nexpect-ct: max-age=86400, enforce\r\nreferrer-policy: same-origin\r\nx-xss-protection: 1; mode=block\r\ncf-ray: 9d274e14c9c18deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":121205,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65367), with CRLF line terminators","md5":"5057f321f0dc85cd8da94a0c5f67a8f4","sha1":"224c9f9ad11b495358aa61dbd53e838e9b61015b","sha256":"5a3d8c05785485d36ee5c94d4681e5b1d9e4b94c5be8b5bd7b0f3168fff1bd9a","sha512":"4056508074c098e63356f88b53f8abdacae6bdd46e76e79028505be5d94ed6ec9cc6513ce2dbd1b398b23649a0e260f989b28669594df847daf3010fe296fe5d","ssdeep":"768:Xy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1Fx:Jw/a1fIuiHlq5mN8lDbNmPbU","tlshash":"1fc3c7a0f21031ea7333c55a75d0ed872219a153e66a4fb7f22f25d88f845ca1673f1a","first_seen":"2023-04-06T18:35:09Z","last_seen":"2026-08-20T04:21:15.72482Z","times_seen":5216,"resource_available":false,"data":null}},"time_used":144,"timings":{"blocked":61,"dns":37,"connect":1,"send":0,"wait":18,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"appealportal-x.click/assets/css/style.css?v=524913","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:08.711Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/css/style.css?v=524913 HTTP/1.1\r\nHost: appealportal-x.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 23 Feb 2026 14:10:08 GMT\r\nContent-Type: text/css\r\nContent-Length: 1615\r\nConnection: keep-alive\r\nContent-Encoding: gzip\r\nLast-Modified: Fri, 26 Apr 2024 11:47:34 GMT\r\nAccept-Ranges: bytes\r\nETag: \"0f387cf97da1:0\"\r\nVary: Accept-Encoding\r\nServer: cloudflare\r\nX-Powered-By: ASP.NET\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9sRt9YW48vzJb70NBVyrsL7utXlfR8DK2oiDkDMU4U0lY1Juxe%2BXLsaH%2Bhl15UVEyakjuu5n%2FDRZImnIy9dwB7NlV6SV8htU%2F0jaUWO2HDiXTZuQ\"}]}\r\nCF-RAY: 9d274e1469171806-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]}],"data":{"size":4062,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4062), with no line terminators","md5":"b584024bc4412dd1595cf1cb48cf0489","sha1":"fba62ba74b543d38bcdba0ce5bc873ef0c720c87","sha256":"e74d756fa5ef416a8e79ee1a1a6dcc8137219a9924872df322dbd7c1455e2cbc","sha512":"4c82114528901475a2212bebcf41411a4e5c5720c3ba55c9452f0df4eadf15f9306cf5e0f1d14bdddbec2dc5c5170c89a71f90b02994d2c97194c8a33f99f682","ssdeep":"","tlshash":"aa81942292627228742f853f658451683239f232db271dfdb7d3e019d7c2b9753b2329","first_seen":"2025-04-08T10:01:35.550296Z","last_seen":"2026-07-20T23:26:03.324598Z","times_seen":307,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:08Z","timestamp":1771855808,"ip_dst":{"addr":"188.114.96.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":44052,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:08.862260+0000\",\"flow_id\":2115227902596153,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":44052,\"dest_ip\":\"188.114.96.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/assets/css/style.css?v=524913\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/css\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":727},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":10,\"pkts_toclient\":10,\"bytes_toserver\":1449,\"bytes_toclient\":7676,\"start\":\"2026-02-23T14:10:08.447545+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"appealportal-x.click/assets/img/atakdomain-logo.webp","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:08.716Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/img/atakdomain-logo.webp HTTP/1.1\r\nHost: appealportal-x.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 23 Feb 2026 14:10:09 GMT\r\nContent-Type: image/webp\r\nContent-Length: 73152\r\nConnection: keep-alive\r\nLast-Modified: Fri, 26 Apr 2024 11:47:35 GMT\r\nAccept-Ranges: bytes\r\nETag: \"c342b987cf97da1:0\"\r\nServer: cloudflare\r\nX-Powered-By: ASP.NET\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O99LZUjCInZbQ43yVfZzIFdsUO%2FdneCmtim5lhzDChaXUv3UMfAHklvRQseJh1dTIWiTZyDSxE1A2jbS5N2iXUkkCZgYaDArytAingcQCUolyZeS\"}]}\r\nCF-RAY: 9d274e156b88c8cb-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":73152,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"af769c3c366984c7fb14af0cb84efb05","sha1":"1c732c36e94446853978fcc859ed4800fbe5ea84","sha256":"21c1c28763ee05914abc041fc19402081b69c4547dadf13f2d4b32712885e36f","sha512":"d7bd3ccdbc11699b094dd2d71a4d64a4bb87e64ff233701816941e458196cc15a7f54457610c2cba9a702491e5c36bd201d2189593bf34105c29057f83981e58","ssdeep":"1536:3iXVQHHM3hv5Zhd4rGnh9uF3a50tsFAz8Ms2nO:3KQnaZhd4ynu33gt2O","tlshash":"2c6301a9fcb2a341c961a77c21e4f9493c769386e715c4827acdec340b2d846da9f5c3","first_seen":"2025-03-27T02:53:07.109822Z","last_seen":"2026-07-20T23:26:03.321867Z","times_seen":308,"resource_available":false,"data":null}},"time_used":601,"timings":{"blocked":147,"dns":1,"connect":8,"send":0,"wait":166,"receive":134,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:09Z","timestamp":1771855809,"ip_dst":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":39702,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:09.029092+0000\",\"flow_id\":612519777457204,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":39702,\"dest_ip\":\"188.114.97.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/assets/img/atakdomain-logo.webp\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/webp\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":774},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":7,\"bytes_toserver\":657,\"bytes_toclient\":7710,\"start\":\"2026-02-23T14:10:08.709684+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"appealportal-x.click/assets/img/bg-9.jpg","fqdn":"appealportal-x.click","domain":"appealportal-x.click","tld":"click"},"ip":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://appealportal-x.click/","date":"2026-02-23T14:10:09.377Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/img/bg-9.jpg HTTP/1.1\r\nHost: appealportal-x.click\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://appealportal-x.click/\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 23 Feb 2026 14:10:09 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 306338\r\nConnection: keep-alive\r\nLast-Modified: Fri, 26 Apr 2024 11:47:36 GMT\r\nAccept-Ranges: bytes\r\nETag: \"d4c17d88cf97da1:0\"\r\nServer: cloudflare\r\nX-Powered-By: ASP.NET\r\nCache-Control: max-age=14400\r\ncf-cache-status: MISS\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6oFzIBVKjpRTGD6XHQNm9EXlozfZykSzdAZVyTNE1coiJhz9eHrKS4xETPKu60uag%2BvM8vNWxf5%2FCtXIS8ErTcKa%2BNLBReBbNKQD884TN60azjgM\"}]}\r\nCF-RAY: 9d274e189c92c8cb-ARN\r\nalt-svc: h2=\":443\"; ma=60\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":306338,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=0], progressive, precision 8, 1621x1080, components 3","md5":"cdf0364a3ab88b78394c519915ee4003","sha1":"8601ed87a28d8edbf2898bb8e23de92ffd7baf9f","sha256":"d2ee3b3ce96f4eb4f075202183a0693a30f16c2c6fab04d74c3d586052f1b78a","sha512":"93a243c66b106884ac243af8eaf5e7f1e468025cb351c288336f3b350ba1582b21bb725615f11f6de57cf5e92c716fdb210395ecf05d7df9fdf6f12b8cfc9631","ssdeep":"6144:JjwDaDhd7v/hhDPduxnQWwb8AzsWAJGRvH18WG6CWhRAfKlEgreAQ8cV+Clf:Rft5DVuRQZb8APH1EgACqCzcMCl","tlshash":"3254231090ab7f4ccb097cb404293560fa699eaf570584bb9c69d033d92d6fbcdb2e06","first_seen":"2025-08-17T21:53:25.030291Z","last_seen":"2026-06-03T23:35:07.833547Z","times_seen":34,"resource_available":false,"data":null}},"time_used":497,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":139,"receive":358,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-02-23T14:10:09Z","timestamp":1771855809,"ip_dst":{"addr":"188.114.97.1","port":80,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"172.18.0.49","port":39702,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ETPRO INFO HTTP Request to a *.click domain","source":"{\"timestamp\":\"2026-02-23T14:10:09.515503+0000\",\"flow_id\":612519777457204,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":39702,\"dest_ip\":\"188.114.97.1\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":1,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2858675,\"rev\":1,\"signature\":\"ETPRO INFO HTTP Request to a *.click domain\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"confidence\":[\"High\"],\"created_at\":[\"2024_10_10\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_10_10\"]}},\"http\":{\"hostname\":\"appealportal-x.click\",\"url\":\"/assets/img/bg-9.jpg\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"image/jpeg\",\"http_refer\":\"http://appealportal-x.click/\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":769},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":46,\"pkts_toclient\":62,\"bytes_toserver\":3802,\"bytes_toclient\":85166,\"start\":\"2026-02-23T14:10:08.709684+0000\"}}"}],"analyzer":null,"urlquery":null}}]}