Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://dtrnconsulta.com/hnvwk

Overview

General Information

Sample URL:https://dtrnconsulta.com/hnvwk
Analysis ID:1593135
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
AI detected suspicious Javascript
Detected suspicious crossdomain redirect
HTML page contains hidden javascript code

Classification

Process Tree

  • System is w10x64
  • chrome.exe (PID: 2916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 1544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2140,i,14077100606901217665,11890294858342083006,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dtrnconsulta.com/hnvwk" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for URL or domain
Source: https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/flow/ov1/2145603863:1737058317:VtFr33mDKD2pn-nQny-_tCmIPBAIaigR746xGJkyGW0/903112caee240c7a/PTYT7zyAOgo4VQZL8cUrMiwLdB9mssZcDsY4P22_G_8-1737061628-1.2.1.1-C0fUZxc3UPnEu3f6WwwEhDcPUpw4AqAzQgxfH8xFyAY58K8yPhjKmCmaMr2B7RigAvira URL Cloud: Label: phishing
Source: https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/672eb098a9f3/main.js?Avira URL Cloud: Label: phishing
Source: https://metin2odisey.com/cdn-cgi/challenge-platform/scripts/jsd/main.jsAvira URL Cloud: Label: phishing
Source: https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=903112caee240c7aAvira URL Cloud: Label: phishing
Source: https://metin2odisey.com/favicon.icoAvira URL Cloud: Label: phishing

Phishing

barindex
AI detected suspicious Javascript
Source: 1.9.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://metin2odisey.com/verytrue/... This JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `eval`, `Function` constructor, and heavily encoded strings indicates a high likelihood of malicious intent. Additionally, the script appears to be sending user data to external domains, which raises concerns about data privacy and security. Overall, this script demonstrates a clear pattern of suspicious and potentially harmful activities, warranting a high-risk score.
Source: 1.0.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://fortishomebuilders.com/... This script demonstrates high-risk behavior by attempting to redirect the user to an external domain, potentially for malicious purposes. The use of the `window.onerror` event handler to trigger the `process()` function is also concerning, as it could be used to intercept and handle errors in a way that compromises the user's security. Overall, this script exhibits behaviors that are highly suspicious and potentially malicious.
Source: https://metin2odisey.com/verytrue/HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....
Source: https://dtrnconsulta.com/hnvwkHTTP Parser: No favicon
Source: https://metin2odisey.com/verytrue/HTTP Parser: No favicon
Source: https://metin2odisey.com/verytrue/HTTP Parser: No favicon
Source: https://metin2odisey.com/verytrue/HTTP Parser: No favicon
Source: https://metin2odisey.com/verytrue/HTTP Parser: No favicon
Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: metin2odisey.com to https://href.li/?https://en.wikipedia.org/wiki/client_access_license#dummybot
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /hnvwk HTTP/1.1Host: dtrnconsulta.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dtrnconsulta.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dtrnconsulta.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: fortishomebuilders.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /verytrue/ HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://fortishomebuilders.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /verytrue/ HTTP/1.1Host: metin2odisey.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://fortishomebuilders.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=903112caee240c7a HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://metin2odisey.com/verytrue/?__cf_chl_rt_tk=f970zw3KAn9h5CNGwUP4ucVHF3Sp5YVkI.J0J9hMAHw-1737061628-1.0.1.1-t4obkpJnuet9MSI1y7ODqemeXtxZ8R8jeCrEDqTp3e8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /turnstile/v0/g/672eb098a9f3/api.js?onload=nAlgo7&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://metin2odisey.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=903112caee240c7a HTTP/1.1Host: metin2odisey.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://metin2odisey.com/verytrue/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /turnstile/v0/g/672eb098a9f3/api.js?onload=nAlgo7&render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2145603863:1737058317:VtFr33mDKD2pn-nQny-_tCmIPBAIaigR746xGJkyGW0/903112caee240c7a/PTYT7zyAOgo4VQZL8cUrMiwLdB9mssZcDsY4P22_G_8-1737061628-1.2.1.1-C0fUZxc3UPnEu3f6WwwEhDcPUpw4AqAzQgxfH8xFyAY58K8yPhjKmCmaMr2B7Rig HTTP/1.1Host: metin2odisey.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/3djd5/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=903112e0daeb0c84&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/3djd5/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/3djd5/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=903112e0daeb0c84&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://metin2odisey.com/verytrue/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2031134020:1737058434:c-z86qu5zQeSlhcF_YB19pGLXXUhcvHTmjc4CYkbnEw/903112e0daeb0c84/DvnHb7CL7RSAt_vpM7SLK34ur5KjtWnxycs6RyWN8qE-1737061632-1.1.1.1-k9XgdELB3bNTs8JW_P6fjLXB5bNHz2is_tzzqacb5ysIDE2msYnPrQn8ZVXg9hZy HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/903112e0daeb0c84/1737061634197/qfMRqOc8eRxuhhn HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/3djd5/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/d/903112e0daeb0c84/1737061634197/qfMRqOc8eRxuhhn HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/903112e0daeb0c84/1737061634198/9bc8e4a6714402bad0f9db6672079c2e5fe4b6d9be67268acd6c9770ef20e617/rF1jR65NlXmLXQJ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/3djd5/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2031134020:1737058434:c-z86qu5zQeSlhcF_YB19pGLXXUhcvHTmjc4CYkbnEw/903112e0daeb0c84/DvnHb7CL7RSAt_vpM7SLK34ur5KjtWnxycs6RyWN8qE-1737061632-1.1.1.1-k9XgdELB3bNTs8JW_P6fjLXB5bNHz2is_tzzqacb5ysIDE2msYnPrQn8ZVXg9hZy HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2031134020:1737058434:c-z86qu5zQeSlhcF_YB19pGLXXUhcvHTmjc4CYkbnEw/903112e0daeb0c84/DvnHb7CL7RSAt_vpM7SLK34ur5KjtWnxycs6RyWN8qE-1737061632-1.1.1.1-k9XgdELB3bNTs8JW_P6fjLXB5bNHz2is_tzzqacb5ysIDE2msYnPrQn8ZVXg9hZy HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2145603863:1737058317:VtFr33mDKD2pn-nQny-_tCmIPBAIaigR746xGJkyGW0/903112caee240c7a/PTYT7zyAOgo4VQZL8cUrMiwLdB9mssZcDsY4P22_G_8-1737061628-1.2.1.1-C0fUZxc3UPnEu3f6WwwEhDcPUpw4AqAzQgxfH8xFyAY58K8yPhjKmCmaMr2B7Rig HTTP/1.1Host: metin2odisey.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://metin2odisey.com/verytrue/?__cf_chl_tk=f970zw3KAn9h5CNGwUP4ucVHF3Sp5YVkI.J0J9hMAHw-1737061628-1.0.1.1-t4obkpJnuet9MSI1y7ODqemeXtxZ8R8jeCrEDqTp3e8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=RG7vAuKIucy36dS8vs57JBarXy4QfrOcDqulZhT53SE-1737061628-1.2.1.1-IVnPSo8vQQ9i7HMBP50ZBOl72i9TRpPBq109HfinZPAIuu0O98ztQmdO_LGVLgg8ZM6nQco9p9OutTgRJ7KNRsmzVPLdLww0aNOGDdQvIxy1j.h5DHsofBfeIXPk.6DSOF4GYzdpUt5dBIWwK_C0IO6wgA4SyechR3fNt5ib_tSqPpW4wtfwkTUNiCphemb90I8V8.gyEdgsC_frMvL9HrDAPxeETSbCJFo_kMOayhFdZF8Nyymog2Yv3KRp6tK9NqBBGfnhXHAaGBXX7B5a6OYYEAHhXkpJWVWsiHispHiRd1JJPE6ikqKh7lCoOD0I0EcfY1Syd1leas8yv5oB1g; PHPSESSID=04162e6f1573dff742842cd1a6c4665c
Source: global trafficHTTP traffic detected: GET /verytrue/CsVEreaK3cg2hiM2i9rWOgPd0UIHCboLhwDaUtnt75mPaj1xQzmIvxnFul8uVslQR4qx15odk9XpjSNcZ3WS6NoeEHQAGE8wvbvMtfky6g9oyonDzimRLXuY3qLsJT4RbpTDqJl6IUOfWCc5Xo8S7K/index HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://metin2odisey.com/verytrue/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=RG7vAuKIucy36dS8vs57JBarXy4QfrOcDqulZhT53SE-1737061628-1.2.1.1-IVnPSo8vQQ9i7HMBP50ZBOl72i9TRpPBq109HfinZPAIuu0O98ztQmdO_LGVLgg8ZM6nQco9p9OutTgRJ7KNRsmzVPLdLww0aNOGDdQvIxy1j.h5DHsofBfeIXPk.6DSOF4GYzdpUt5dBIWwK_C0IO6wgA4SyechR3fNt5ib_tSqPpW4wtfwkTUNiCphemb90I8V8.gyEdgsC_frMvL9HrDAPxeETSbCJFo_kMOayhFdZF8Nyymog2Yv3KRp6tK9NqBBGfnhXHAaGBXX7B5a6OYYEAHhXkpJWVWsiHispHiRd1JJPE6ikqKh7lCoOD0I0EcfY1Syd1leas8yv5oB1g; PHPSESSID=04162e6f1573dff742842cd1a6c4665c
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/672eb098a9f3/main.js? HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=RG7vAuKIucy36dS8vs57JBarXy4QfrOcDqulZhT53SE-1737061628-1.2.1.1-IVnPSo8vQQ9i7HMBP50ZBOl72i9TRpPBq109HfinZPAIuu0O98ztQmdO_LGVLgg8ZM6nQco9p9OutTgRJ7KNRsmzVPLdLww0aNOGDdQvIxy1j.h5DHsofBfeIXPk.6DSOF4GYzdpUt5dBIWwK_C0IO6wgA4SyechR3fNt5ib_tSqPpW4wtfwkTUNiCphemb90I8V8.gyEdgsC_frMvL9HrDAPxeETSbCJFo_kMOayhFdZF8Nyymog2Yv3KRp6tK9NqBBGfnhXHAaGBXX7B5a6OYYEAHhXkpJWVWsiHispHiRd1JJPE6ikqKh7lCoOD0I0EcfY1Syd1leas8yv5oB1g; PHPSESSID=04162e6f1573dff742842cd1a6c4665c
Source: global trafficHTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/672eb098a9f3/main.js? HTTP/1.1Host: metin2odisey.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=04162e6f1573dff742842cd1a6c4665c
Source: global trafficHTTP traffic detected: GET /verytrue/CsVEreaK3cg2hiM2i9rWOgPd0UIHCboLhwDaUtnt75mPaj1xQzmIvxnFul8uVslQR4qx15odk9XpjSNcZ3WS6NoeEHQAGE8wvbvMtfky6g9oyonDzimRLXuY3qLsJT4RbpTDqJl6IUOfWCc5Xo8S7K/verify HTTP/1.1Host: metin2odisey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://metin2odisey.com/verytrue/CsVEreaK3cg2hiM2i9rWOgPd0UIHCboLhwDaUtnt75mPaj1xQzmIvxnFul8uVslQR4qx15odk9XpjSNcZ3WS6NoeEHQAGE8wvbvMtfky6g9oyonDzimRLXuY3qLsJT4RbpTDqJl6IUOfWCc5Xo8S7K/indexAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cf_clearance=RG7vAuKIucy36dS8vs57JBarXy4QfrOcDqulZhT53SE-1737061628-1.2.1.1-IVnPSo8vQQ9i7HMBP50ZBOl72i9TRpPBq109HfinZPAIuu0O98ztQmdO_LGVLgg8ZM6nQco9p9OutTgRJ7KNRsmzVPLdLww0aNOGDdQvIxy1j.h5DHsofBfeIXPk.6DSOF4GYzdpUt5dBIWwK_C0IO6wgA4SyechR3fNt5ib_tSqPpW4wtfwkTUNiCphemb90I8V8.gyEdgsC_frMvL9HrDAPxeETSbCJFo_kMOayhFdZF8Nyymog2Yv3KRp6tK9NqBBGfnhXHAaGBXX7B5a6OYYEAHhXkpJWVWsiHispHiRd1JJPE6ikqKh7lCoOD0I0EcfY1Syd1leas8yv5oB1g; PHPSESSID=04162e6f1573dff742842cd1a6c4665c
Source: global trafficHTTP traffic detected: GET /?https://en.wikipedia.org/wiki/Client_access_license HTTP/1.1Host: href.liConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://metin2odisey.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /wiki/Client_access_license HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022 HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=site.styles&only=styles&skin=vector-2022 HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/mobile/copyright/wikipedia-wordmark-en.svg HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector-2022 HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/icons/wikipedia.png HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/mobile/copyright/wikipedia-tagline-en.svg HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?modules=skins.vector.icons&image=language&variant=progressive&format=original&lang=en&skin=vector-2022&version=zjugj HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://en.wikipedia.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/mobile/copyright/wikipedia-wordmark-en.svg HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?modules=skins.vector.icons&image=menu&format=original&lang=en&skin=vector-2022&version=zjugj HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://en.wikipedia.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?modules=skins.vector.icons&image=ellipsis&format=original&lang=en&skin=vector-2022&version=zjugj HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://en.wikipedia.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/skins/Vector/resources/skins.vector.styles/images/link-external-small-ltr-progressive.svg?fb64d HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/icons/wikipedia.png HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/mobile/copyright/wikipedia-tagline-en.svg HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector-2022 HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.gadget.ReferenceTooltips%2Cswitcher&skin=vector-2022&version=12u7u HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.visualEditor.core.utils.parsing%7Cext.visualEditor.desktopArticleTarget.init%7Cext.visualEditor.progressBarWidget%2CsupportCheck%2CtargetLoader%2CtempWikitextEditorWidget%2Ctrack%2Cve&skin=vector-2022&version=1wwpp HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.centralNotice.choiceData%2Cdisplay%2CgeoIP%2CimpressionDiet%2CkvStore%2CstartUp%7Cext.centralauth.ForeignApi%2Ccentralautologin%7Cext.checkUser.clientHints%7Cext.cite.ux-enhancements%7Cext.cx.eventlogging.campaigns%7Cext.cx.model%7Cext.cx.uls.quick.actions%7Cext.echo.centralauth%7Cext.eventLogging%2CnavigationTiming%2Cpopups%2CwikimediaEvents%7Cext.growthExperiments.SuggestedEditSession%7Cext.uls.common%2Cinterface%2Cpreferences%2Cwebfonts%7Cext.urlShortener.toolbar%7Cjquery%2Coojs%2Csite%7Cjquery.client%2CtextSelection%7Cjquery.uls.data%7Cmediawiki.ForeignApi%2CString%2CTitle%2CUri%2Capi%2Cbase%2Ccldr%2Ccookie%2Cexperiments%2CjqueryMsg%2Clanguage%2Cstorage%2Ctoc%2Cuser%2Cutil%2CvisibleTimeout%7Cmediawiki.ForeignApi.core%7Cmediawiki.editfont.styles%7Cmediawiki.libs.pluralruleparser%7Cmediawiki.page.ready%7Cmediawiki.page.watch.ajax%7Cmw.cx.SiteMapper%7Coojs-ui.styles.icons-interactions%7Cskins.vector.clientPreferences%2Cjs%7Cskins.vector.icons.js%7Cwikibase.client.vector-2022&skin=vector-2022&version=1jnq1 HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?modules=skins.vector.icons&image=language&variant=progressive&format=original&lang=en&skin=vector-2022&version=zjugj HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?modules=skins.vector.icons&image=menu&format=original&lang=en&skin=vector-2022&version=zjugj HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?modules=skins.vector.icons&image=ellipsis&format=original&lang=en&skin=vector-2022&version=zjugj HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/skins/Vector/resources/skins.vector.styles/images/link-external-small-ltr-progressive.svg?fb64d HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.gadget.ReferenceTooltips%2Cswitcher&skin=vector-2022&version=12u7u HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.visualEditor.core.utils.parsing%7Cext.visualEditor.desktopArticleTarget.init%7Cext.visualEditor.progressBarWidget%2CsupportCheck%2CtargetLoader%2CtempWikitextEditorWidget%2Ctrack%2Cve&skin=vector-2022&version=1wwpp HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/project-logos/enwiki.png HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/favicon/wikipedia.ico HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.centralNotice.choiceData%2Cdisplay%2CgeoIP%2CimpressionDiet%2CkvStore%2CstartUp%7Cext.centralauth.ForeignApi%2Ccentralautologin%7Cext.checkUser.clientHints%7Cext.cite.ux-enhancements%7Cext.cx.eventlogging.campaigns%7Cext.cx.model%7Cext.cx.uls.quick.actions%7Cext.echo.centralauth%7Cext.eventLogging%2CnavigationTiming%2Cpopups%2CwikimediaEvents%7Cext.growthExperiments.SuggestedEditSession%7Cext.uls.common%2Cinterface%2Cpreferences%2Cwebfonts%7Cext.urlShortener.toolbar%7Cjquery%2Coojs%2Csite%7Cjquery.client%2CtextSelection%7Cjquery.uls.data%7Cmediawiki.ForeignApi%2CString%2CTitle%2CUri%2Capi%2Cbase%2Ccldr%2Ccookie%2Cexperiments%2CjqueryMsg%2Clanguage%2Cstorage%2Ctoc%2Cuser%2Cutil%2CvisibleTimeout%7Cmediawiki.ForeignApi.core%7Cmediawiki.editfont.styles%7Cmediawiki.libs.pluralruleparser%7Cmediawiki.page.ready%7Cmediawiki.page.watch.ajax%7Cmw.cx.SiteMapper%7Coojs-ui.styles.icons-interactions%7Cskins.vector.clientPreferences%2Cjs%7Cskins.vector.icons.js%7Cwikibase.client.vector-2022&skin=vector-2022&version=1jnq1 HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=mw.config.values.wbCurrentSiteDetails%2CwbRepo%7Coojs-ui.styles.icons-editing-core&skin=vector-2022&version=1ezz7 HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /wiki/Special:CentralAutoLogin/start?type=script HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.cite.referencePreviews%7Cext.math.popup%7Cext.popups.main&skin=vector-2022&version=1td88 HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001
Source: global trafficHTTP traffic detected: GET /static/images/project-logos/enwiki.png HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /static/favicon/wikipedia.ico HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&type=script&wikiid=enwiki&type=script HTTP/1.1Host: login.wikimedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://en.wikipedia.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=mw.config.values.wbCurrentSiteDetails%2CwbRepo%7Coojs-ui.styles.icons-editing-core&skin=vector-2022&version=1ezz7 HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /w/load.php?lang=en&modules=ext.cite.referencePreviews%7Cext.math.popup%7Cext.popups.main&skin=vector-2022&version=1td88 HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&type=script&wikiid=enwiki&type=script HTTP/1.1Host: login.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /api/rest_v1/page/summary/Server_software HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json; charset=utf-8; profile="https://www.mediawiki.org/wiki/Specs/Summary/1.2.0"Accept-Language: ensec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brCookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /api/rest_v1/page/summary/Server_(computing) HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json; charset=utf-8; profile="https://www.mediawiki.org/wiki/Specs/Summary/1.2.0"Accept-Language: ensec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brCookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /api/rest_v1/page/summary/Server_(computing) HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /api/rest_v1/page/summary/Server_software HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json; charset=utf-8; profile="https://www.mediawiki.org/wiki/Specs/Summary/1.2.0"Accept-Language: ensec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brCookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98e
Source: global trafficHTTP traffic detected: GET /api/rest_v1/page/summary/Server_(computing) HTTP/1.1Host: en.wikipedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json; charset=utf-8; profile="https://www.mediawiki.org/wiki/Specs/Summary/1.2.0"Accept-Language: ensec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://en.wikipedia.org/wiki/Client_access_licenseAccept-Encoding: gzip, deflate, brCookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98eIf-None-Match: W/"1265270284/351974c0-d21d-11ef-aaaa-90ccd02a326e"
Source: global trafficHTTP traffic detected: GET /api/rest_v1/page/summary/Server_(computing) HTTP/1.1Host: en.wikipedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WMF-Last-Access=16-Jan-2025; WMF-Last-Access-Global=16-Jan-2025; WMF-DP=a8b; GeoIP=US:NY:New_York:40.71:-74.01:v4; NetworkProbeLimit=0.001; enwikimwuser-sessionId=e9901e6789977a5ed98eIf-None-Match: W/"1265270284/351974c0-d21d-11ef-aaaa-90ccd02a326e"
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: fortishomebuilders.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: 757b3e01c=3e01cf63d8d2
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fortishomebuilders.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://fortishomebuilders.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: 757b3e01c=3e01cf63d8d2
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: dtrnconsulta.com
Source: global trafficDNS traffic detected: DNS query: fortishomebuilders.com
Source: global trafficDNS traffic detected: DNS query: metin2odisey.com
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: href.li
Source: global trafficDNS traffic detected: DNS query: en.wikipedia.org
Source: global trafficDNS traffic detected: DNS query: meta.wikimedia.org
Source: global trafficDNS traffic detected: DNS query: login.wikimedia.org
Source: unknownHTTP traffic detected: POST /report/v4?s=Eea3yg8G1o3p%2FBHr78EasUsEuAT0m2SIm%2Fs7gUsZsvxj6hPNk3Auf6CJdrqnJaeMF5vOY8JlddFg4rmIVg%2F8hq%2Bl%2FBxuy4C8%2BZJDKM%2BCrTBn2cfCKeh6IlUxMVXRtcK9rWdz HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 426Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 16 Jan 2025 21:07:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originx-content-options: nosniffx-frame-options: SAMEORIGINcf-mitigated: challenge
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 16 Jan 2025 21:07:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originx-content-options: nosniffx-frame-options: SAMEORIGINcf-mitigated: challenge
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 16 Jan 2025 21:07:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originx-content-options: nosniffx-frame-options: SAMEORIGINcf-mitigated: challenge
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 16 Jan 2025 21:07:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originx-content-options: nosniffx-frame-options: SAMEORIGINcf-mitigated: challenge
Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 16 Jan 2025 21:07:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeaccept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcritical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAcross-origin-embedder-policy: require-corpcross-origin-opener-policy: same-origincross-origin-resource-policy: same-originorigin-agent-cluster: ?1permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()referrer-policy: same-originx-content-options: nosniffx-frame-options: SAMEORIGINcf-mitigated: challenge
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 16 Jan 2025 21:07:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e bf 0a c2 30 10 c6 77 c1 77 38 1f 20 44 a1 63 c8 22 0a 0e ba f8 04 a9 77 36 81 34 57 ae 71 c8 db 9b 6a 0b e2 ec e8 74 dc f7 e7 c7 67 7c ee a3 5d af 8c 27 87 d6 e4 90 23 d9 66 db c0 85 33 1c f9 91 d0 e8 b7 68 f4 2b 52 a3 2d 63 99 ee 8d 52 26 b1 c6 ef be 1b 55 31 7a b6 27 76 0d cd 1f 0f 94 84 c6 5c 3e 7d bd 10 f5 b2 66 a3 14 38 18 1c 62 48 1d 64 06 0c a3 6b 23 c1 f9 7a 3a 80 4b 08 7b 2f dc 13 dc 25 50 c2 58 80 44 58 6a a3 23 50 ea 8f f8 35 e2 09 11 d4 0d c8 28 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90ww8 Dc"w64Wqjtg|]'#f3h+R-cR&U1z'v\>}f8bHdk#z:K{/%PXDXj#P5(0
Source: chromecache_102.2.drString found in binary or memory: http://fortishomebuilders.com/
Source: chromecache_112.2.drString found in binary or memory: http://www.mslicensing.fr/theorie/core-cal-vs-enteeprise-cal
Source: chromecache_112.2.drString found in binary or memory: http://www.msterminalservices.org/articles/Changes-Windows-Server-2008-Terminal-Server-Licensing-Par
Source: chromecache_112.2.drString found in binary or memory: http://www.networkworld.com/community/node/61283
Source: chromecache_112.2.drString found in binary or memory: https://archive.today/20120906095448/http://www.msterminalservices.org/articles/Changes-Windows-Serv
Source: chromecache_112.2.drString found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/deed.en
Source: chromecache_112.2.drString found in binary or memory: https://developer.wikimedia.org
Source: chromecache_112.2.drString found in binary or memory: https://donate.wikimedia.org/?wmf_source=donate&amp;wmf_medium=sidebar&amp;wmf_campaign=en.wikipedia
Source: chromecache_75.2.drString found in binary or memory: https://fortishomebuilders.com/
Source: chromecache_112.2.drString found in binary or memory: https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Cookie_statement
Source: chromecache_112.2.drString found in binary or memory: https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy
Source: chromecache_112.2.drString found in binary or memory: https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Use
Source: chromecache_112.2.drString found in binary or memory: https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Universal_Code_of_Conduct
Source: chromecache_108.2.dr, chromecache_95.2.drString found in binary or memory: https://intake-analytics.wikimedia.org
Source: chromecache_108.2.dr, chromecache_95.2.drString found in binary or memory: https://intake-analytics.wikimedia.org/v1/events?hasty=true
Source: chromecache_108.2.dr, chromecache_95.2.drString found in binary or memory: https://intake-logging.wikimedia.org/v1/events?hasty=true
Source: chromecache_112.2.drString found in binary or memory: https://login.wikimedia.org/wiki/Special:CentralAutoLogin/start?useformat=desktop&amp;type=1x1&amp;u
Source: chromecache_78.2.drString found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: chromecache_76.2.dr, chromecache_110.2.drString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/c/c0/MediaWiki_footer_link_ltr.svg
Source: chromecache_111.2.dr, chromecache_104.2.drString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c9/Client-server-model.svg/320px-Client-serve
Source: chromecache_111.2.dr, chromecache_104.2.drString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c9/Client-server-model.svg/500px-Client-serve
Source: chromecache_112.2.drString found in binary or memory: https://wikimediafoundation.org/
Source: chromecache_112.2.drString found in binary or memory: https://www.mediawiki.org/
Source: chromecache_108.2.dr, chromecache_95.2.drString found in binary or memory: https://www.mediawiki.org/w/api.php
Source: chromecache_93.2.dr, chromecache_97.2.drString found in binary or memory: https://www.mediawiki.org/wiki/Extension:VisualEditor/Skin_requirements
Source: chromecache_93.2.dr, chromecache_97.2.drString found in binary or memory: https://www.mediawiki.org/wiki/Manual:Messages_API#Feature_support_in_JavaScript
Source: chromecache_93.2.dr, chromecache_97.2.drString found in binary or memory: https://www.mediawiki.org/wiki/Specs/HTML/2.8.0
Source: chromecache_71.2.dr, chromecache_78.2.drString found in binary or memory: https://www.mediawiki.org/wiki/Specs/Summary/1.2.0
Source: chromecache_112.2.drString found in binary or memory: https://www.techtarget.com/searchvirtualdesktop/tip/Remote-Desktop-Services-licensing-rules-and-reco
Source: chromecache_112.2.drString found in binary or memory: https://www.theregister.com/2020/03/20/surge_in_home_working/
Source: chromecache_82.2.dr, chromecache_101.2.drString found in binary or memory: https://www.wikidata.org
Source: chromecache_108.2.dr, chromecache_95.2.drString found in binary or memory: https://www.wikidata.org/w/api.php
Source: chromecache_112.2.drString found in binary or memory: https://www.wikidata.org/wiki/Special:EntityPage/Q1100998
Source: chromecache_112.2.drString found in binary or memory: https://www.wikidata.org/wiki/Special:EntityPage/Q1100998#sitelinks-wikipedia
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49953
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49958 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 49865 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49953 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49899 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49959 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: classification engineClassification label: mal52.win@25/81@34/13
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2140,i,14077100606901217665,11890294858342083006,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://dtrnconsulta.com/hnvwk"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2140,i,14077100606901217665,11890294858342083006,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Browser Extensions		1
Process Injection		1
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media4
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive5
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://dtrnconsulta.com/hnvwk0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://developer.wikimedia.org0%Avira URL Cloudsafe
https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/flow/ov1/2145603863:1737058317:VtFr33mDKD2pn-nQny-_tCmIPBAIaigR746xGJkyGW0/903112caee240c7a/PTYT7zyAOgo4VQZL8cUrMiwLdB9mssZcDsY4P22_G_8-1737061628-1.2.1.1-C0fUZxc3UPnEu3f6WwwEhDcPUpw4AqAzQgxfH8xFyAY58K8yPhjKmCmaMr2B7Rig100%Avira URL Cloudphishing
https://dtrnconsulta.com/favicon.ico0%Avira URL Cloudsafe
https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/672eb098a9f3/main.js?100%Avira URL Cloudphishing
http://www.msterminalservices.org/articles/Changes-Windows-Server-2008-Terminal-Server-Licensing-Par0%Avira URL Cloudsafe
https://metin2odisey.com/cdn-cgi/challenge-platform/scripts/jsd/main.js100%Avira URL Cloudphishing
https://fortishomebuilders.com/0%Avira URL Cloudsafe
http://fortishomebuilders.com/favicon.ico0%Avira URL Cloudsafe
https://wikimediafoundation.org/0%Avira URL Cloudsafe
http://www.mslicensing.fr/theorie/core-cal-vs-enteeprise-cal0%Avira URL Cloudsafe
https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=903112caee240c7a100%Avira URL Cloudphishing
https://metin2odisey.com/favicon.ico100%Avira URL Cloudphishing

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
fortishomebuilders.com
66.63.187.232
truetrue
    		unknown
    a.nel.cloudflare.com
    		35.190.80.1
    		truefalse
      		high
      challenges.cloudflare.com
      		104.18.94.41
      		truefalse
        		high
        www.google.com
        		142.250.184.228
        		truefalse
          		high
          metin2odisey.com
          		104.21.24.140
          		truefalse
            		high
            dyna.wikimedia.org
            		185.15.59.224
            		truefalse
              		high
              dtrnconsulta.com
              		83.217.208.10
              		truefalse
                		unknown
                href.li
                		192.0.78.27
                		truefalse
                  		high
                  en.wikipedia.org
                  		unknown
                  		unknownfalse
                    		high
                    meta.wikimedia.org
                    		unknown
                    		unknownfalse
                      		high
                      login.wikimedia.org
                      		unknown
                      		unknownfalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        https://metin2odisey.com/verytrue/true
                          		unknown
                          http://fortishomebuilders.com/favicon.icofalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/3djd5/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/new/normal/auto/false
                            		high
                            https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/flow/ov1/2145603863:1737058317:VtFr33mDKD2pn-nQny-_tCmIPBAIaigR746xGJkyGW0/903112caee240c7a/PTYT7zyAOgo4VQZL8cUrMiwLdB9mssZcDsY4P22_G_8-1737061628-1.2.1.1-C0fUZxc3UPnEu3f6WwwEhDcPUpw4AqAzQgxfH8xFyAY58K8yPhjKmCmaMr2B7Rigfalse
                            • Avira URL Cloud: phishing
                            		unknown
                            https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/672eb098a9f3/main.js?false
                            • Avira URL Cloud: phishing
                            		unknown
                            https://en.wikipedia.org/w/load.php?lang=en&modules=ext.cite.referencePreviews%7Cext.math.popup%7Cext.popups.main&skin=vector-2022&version=1td88false
                              		high
                              https://en.wikipedia.org/static/favicon/wikipedia.icofalse
                                		high
                                https://en.wikipedia.org/wiki/Client_access_licensefalse
                                  		high
                                  https://login.wikimedia.org/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&wikiid=enwiki&type=script&wikiid=enwiki&type=scriptfalse
                                    		high
                                    https://en.wikipedia.org/api/rest_v1/page/summary/Server_softwarefalse
                                      		high
                                      https://en.wikipedia.org/w/load.php?lang=en&modules=ext.gadget.ReferenceTooltips%2Cswitcher&skin=vector-2022&version=12u7ufalse
                                        		high
                                        https://metin2odisey.com/cdn-cgi/challenge-platform/scripts/jsd/main.jsfalse
                                        • Avira URL Cloud: phishing
                                        		unknown
                                        https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/903112e0daeb0c84/1737061634198/9bc8e4a6714402bad0f9db6672079c2e5fe4b6d9be67268acd6c9770ef20e617/rF1jR65NlXmLXQJfalse
                                          		high
                                          https://en.wikipedia.org/wiki/Special:CentralAutoLogin/start?type=scriptfalse
                                            		high
                                            https://en.wikipedia.org/w/skins/Vector/resources/skins.vector.styles/images/link-external-small-ltr-progressive.svg?fb64dfalse
                                              		high
                                              https://a.nel.cloudflare.com/report/v4?s=Eea3yg8G1o3p%2FBHr78EasUsEuAT0m2SIm%2Fs7gUsZsvxj6hPNk3Auf6CJdrqnJaeMF5vOY8JlddFg4rmIVg%2F8hq%2Bl%2FBxuy4C8%2BZJDKM%2BCrTBn2cfCKeh6IlUxMVXRtcK9rWdzfalse
                                                		high
                                                https://en.wikipedia.org/w/load.php?modules=skins.vector.icons&image=ellipsis&format=original&lang=en&skin=vector-2022&version=zjugjfalse
                                                  		high
                                                  https://en.wikipedia.org/w/load.php?lang=en&modules=site.styles&only=styles&skin=vector-2022false
                                                    		high
                                                    http://fortishomebuilders.com/false
                                                      		unknown
                                                      https://fortishomebuilders.com/true
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://a.nel.cloudflare.com/report/v4?s=jHOZkjl%2BDuqX42ieMVf1XtGb678HBi%2FzC9UCVBUieSOYMCEFaeNzwwMsQlW1vBBZk4jCAl9Hb0LjWkf6qzkaTdICg3XEg0TjVofL3A34lqJy4zFdksQ0KTGtbuebwLLCKf8jfalse
                                                        		high
                                                        https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/2031134020:1737058434:c-z86qu5zQeSlhcF_YB19pGLXXUhcvHTmjc4CYkbnEw/903112e0daeb0c84/DvnHb7CL7RSAt_vpM7SLK34ur5KjtWnxycs6RyWN8qE-1737061632-1.1.1.1-k9XgdELB3bNTs8JW_P6fjLXB5bNHz2is_tzzqacb5ysIDE2msYnPrQn8ZVXg9hZyfalse
                                                          		high
                                                          https://en.wikipedia.org/w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022false
                                                            		high
                                                            https://dtrnconsulta.com/favicon.icofalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://en.wikipedia.org/w/load.php?modules=skins.vector.icons&image=language&variant=progressive&format=original&lang=en&skin=vector-2022&version=zjugjfalse
                                                              		high
                                                              https://en.wikipedia.org/w/load.php?lang=en&modules=mw.config.values.wbCurrentSiteDetails%2CwbRepo%7Coojs-ui.styles.icons-editing-core&skin=vector-2022&version=1ezz7false
                                                                		high
                                                                https://en.wikipedia.org/api/rest_v1/page/summary/Server_(computing)false
                                                                  		high
                                                                  https://href.li/?https://en.wikipedia.org/wiki/Client_access_licensefalse
                                                                    		high
                                                                    https://en.wikipedia.org/static/images/mobile/copyright/wikipedia-wordmark-en.svgfalse
                                                                      		high
                                                                      https://en.wikipedia.org/static/images/mobile/copyright/wikipedia-tagline-en.svgfalse
                                                                        		high
                                                                        https://en.wikipedia.org/w/load.php?modules=skins.vector.icons&image=menu&format=original&lang=en&skin=vector-2022&version=zjugjfalse
                                                                          		high
                                                                          https://en.wikipedia.org/w/load.php?lang=en&modules=ext.visualEditor.core.utils.parsing%7Cext.visualEditor.desktopArticleTarget.init%7Cext.visualEditor.progressBarWidget%2CsupportCheck%2CtargetLoader%2CtempWikitextEditorWidget%2Ctrack%2Cve&skin=vector-2022&version=1wwppfalse
                                                                            		high
                                                                            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1false
                                                                              		high
                                                                              https://metin2odisey.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=903112caee240c7afalse
                                                                              • Avira URL Cloud: phishing
                                                                              		unknown
                                                                              https://en.wikipedia.org/wiki/Client_access_license#DummyBotfalse
                                                                                		high
                                                                                https://metin2odisey.com/favicon.icofalse
                                                                                • Avira URL Cloud: phishing
                                                                                		unknown
                                                                                https://en.wikipedia.org/static/images/icons/wikipedia.pngfalse
                                                                                  		high
                                                                                  https://en.wikipedia.org/static/images/project-logos/enwiki.pngfalse
                                                                                    		high
                                                                                    https://dtrnconsulta.com/hnvwkfalse
                                                                                      		unknown
                                                                                      https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/903112e0daeb0c84/1737061634197/qfMRqOc8eRxuhhnfalse
                                                                                        		high
                                                                                        https://en.wikipedia.org/w/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector-2022false
                                                                                          		high
                                                                                          https://a.nel.cloudflare.com/report/v4?s=gaelyH8Fog3gWSR13CGEFafByMMecEGFfyvzVu5MFNsDgJ%2BHeOS%2BiCsVUgsnwgQTqlBcqcXM2wN0MKNtusFx4gWVH5mDN2Eu8wzS2WYFSBruFvJJWNfQ%2Bq71XwF2coTv%2B%2BU5false
                                                                                            		high
                                                                                            https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=903112e0daeb0c84&lang=autofalse
                                                                                              		high

                                                                                              URLs from Memory and Binaries

                                                                                              NameSourceMaliciousAntivirus DetectionReputation
                                                                                              https://intake-analytics.wikimedia.orgchromecache_108.2.dr, chromecache_95.2.drfalse
                                                                                                		high
                                                                                                https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Usechromecache_112.2.drfalse
                                                                                                  		high
                                                                                                  https://upload.wikimedia.org/wikipedia/commons/thumb/c/c9/Client-server-model.svg/500px-Client-servechromecache_111.2.dr, chromecache_104.2.drfalse
                                                                                                    		high
                                                                                                    https://www.wikidata.org/wiki/Special:EntityPage/Q1100998chromecache_112.2.drfalse
                                                                                                      		high
                                                                                                      https://upload.wikimedia.org/wikipedia/commons/c/c0/MediaWiki_footer_link_ltr.svgchromecache_76.2.dr, chromecache_110.2.drfalse
                                                                                                        		high
                                                                                                        https://developer.wikimedia.orgchromecache_112.2.drfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        https://www.techtarget.com/searchvirtualdesktop/tip/Remote-Desktop-Services-licensing-rules-and-recochromecache_112.2.drfalse
                                                                                                          		high
                                                                                                          https://www.wikidata.orgchromecache_82.2.dr, chromecache_101.2.drfalse
                                                                                                            		high
                                                                                                            https://www.mediawiki.org/wiki/Specs/HTML/2.8.0chromecache_93.2.dr, chromecache_97.2.drfalse
                                                                                                              		high
                                                                                                              https://creativecommons.org/licenses/by-sa/4.0/deed.enchromecache_112.2.drfalse
                                                                                                                		high
                                                                                                                https://www.mediawiki.org/wiki/Specs/Summary/1.2.0chromecache_71.2.dr, chromecache_78.2.drfalse
                                                                                                                  		high
                                                                                                                  https://www.mediawiki.org/wiki/Manual:Messages_API#Feature_support_in_JavaScriptchromecache_93.2.dr, chromecache_97.2.drfalse
                                                                                                                    		high
                                                                                                                    https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policychromecache_112.2.drfalse
                                                                                                                      		high
                                                                                                                      https://login.wikimedia.org/wiki/Special:CentralAutoLogin/start?useformat=desktop&amp;type=1x1&amp;uchromecache_112.2.drfalse
                                                                                                                        		high
                                                                                                                        https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Universal_Code_of_Conductchromecache_112.2.drfalse
                                                                                                                          		high
                                                                                                                          http://www.networkworld.com/community/node/61283chromecache_112.2.drfalse
                                                                                                                            		high
                                                                                                                            https://intake-analytics.wikimedia.org/v1/events?hasty=truechromecache_108.2.dr, chromecache_95.2.drfalse
                                                                                                                              		high
                                                                                                                              https://upload.wikimedia.org/wikipedia/commons/thumb/c/c9/Client-server-model.svg/320px-Client-servechromecache_111.2.dr, chromecache_104.2.drfalse
                                                                                                                                		high
                                                                                                                                https://www.mediawiki.org/wiki/Extension:VisualEditor/Skin_requirementschromecache_93.2.dr, chromecache_97.2.drfalse
                                                                                                                                  		high
                                                                                                                                  https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Cookie_statementchromecache_112.2.drfalse
                                                                                                                                    		high
                                                                                                                                    http://www.mslicensing.fr/theorie/core-cal-vs-enteeprise-calchromecache_112.2.drfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.msterminalservices.org/articles/Changes-Windows-Server-2008-Terminal-Server-Licensing-Parchromecache_112.2.drfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    https://intake-logging.wikimedia.org/v1/events?hasty=truechromecache_108.2.dr, chromecache_95.2.drfalse
                                                                                                                                      		high
                                                                                                                                      https://redux.js.org/api-reference/store#subscribe(listener)chromecache_78.2.drfalse
                                                                                                                                        		high
                                                                                                                                        https://www.wikidata.org/w/api.phpchromecache_108.2.dr, chromecache_95.2.drfalse
                                                                                                                                          		high
                                                                                                                                          https://www.wikidata.org/wiki/Special:EntityPage/Q1100998#sitelinks-wikipediachromecache_112.2.drfalse
                                                                                                                                            		high
                                                                                                                                            https://www.mediawiki.org/w/api.phpchromecache_108.2.dr, chromecache_95.2.drfalse
                                                                                                                                              		high
                                                                                                                                              https://www.theregister.com/2020/03/20/surge_in_home_working/chromecache_112.2.drfalse
                                                                                                                                                		high
                                                                                                                                                https://www.mediawiki.org/chromecache_112.2.drfalse
                                                                                                                                                  		high
                                                                                                                                                  https://wikimediafoundation.org/chromecache_112.2.drfalse
                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://donate.wikimedia.org/?wmf_source=donate&amp;wmf_medium=sidebar&amp;wmf_campaign=en.wikipediachromecache_112.2.drfalse
                                                                                                                                                    		high
                                                                                                                                                    https://archive.today/20120906095448/http://www.msterminalservices.org/articles/Changes-Windows-Servchromecache_112.2.drfalse
                                                                                                                                                      		high

                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                      Public IPs

                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                      104.18.94.41
                                                                                                                                                      		challenges.cloudflare.comUnited States
                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                      104.18.95.41
                                                                                                                                                      		unknownUnited States
                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                      192.0.78.27
                                                                                                                                                      		href.liUnited States
                                                                                                                                                      		2635AUTOMATTICUSfalse
                                                                                                                                                      185.15.59.224
                                                                                                                                                      		dyna.wikimedia.orgNetherlands
                                                                                                                                                      		14907WIKIMEDIAUSfalse
                                                                                                                                                      104.21.24.140
                                                                                                                                                      		metin2odisey.comUnited States
                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                      239.255.255.250
                                                                                                                                                      		unknownReserved
                                                                                                                                                      		unknownunknownfalse
                                                                                                                                                      66.63.187.232
                                                                                                                                                      		fortishomebuilders.comUnited States
                                                                                                                                                      		8100ASN-QUADRANET-GLOBALUStrue
                                                                                                                                                      83.217.208.10
                                                                                                                                                      		dtrnconsulta.comRussian Federation
                                                                                                                                                      		31514INF-NET-ASRUfalse
                                                                                                                                                      35.190.80.1
                                                                                                                                                      		a.nel.cloudflare.comUnited States
                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                      142.250.184.228
                                                                                                                                                      		www.google.comUnited States
                                                                                                                                                      		15169GOOGLEUSfalse

                                                                                                                                                      Private

                                                                                                                                                      IP
                                                                                                                                                      192.168.2.4
                                                                                                                                                      192.168.2.13
                                                                                                                                                      192.168.2.23

                                                                                                                                                      General Information

                                                                                                                                                      Joe Sandbox version:42.0.0 Malachite
                                                                                                                                                      Analysis ID:1593135
                                                                                                                                                      Start date and time:2025-01-16 22:06:03 +01:00
                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                      Overall analysis duration:0h 3m 23s
                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                      Report type:full
                                                                                                                                                      Cookbook file name:browseurl.jbs
                                                                                                                                                      Sample URL:https://dtrnconsulta.com/hnvwk
                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                      Number of analysed new started processes analysed:7
                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                      Technologies:
                                                                                                                                                      • HCA enabled
                                                                                                                                                      • EGA enabled
                                                                                                                                                      • AMSI enabled
                                                                                                                                                      Analysis Mode:default
                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                      Detection:MAL
                                                                                                                                                      Classification:mal52.win@25/81@34/13
                                                                                                                                                      EGA Information:Failed
                                                                                                                                                      HCA Information:
                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                      • Number of executed functions: 0
                                                                                                                                                      • Number of non-executed functions: 0

                                                                                                                                                      Warnings

                                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.186.174, 142.250.110.84, 142.250.184.206, 142.250.181.238, 199.232.210.172, 2.23.77.188, 216.58.206.46, 142.250.185.238, 216.58.206.78, 142.250.74.206, 142.250.186.170, 142.250.185.74, 142.250.186.138, 172.217.16.202, 142.250.185.138, 142.250.184.234, 142.250.186.42, 142.250.185.202, 142.250.185.170, 172.217.16.138, 142.250.186.106, 142.250.185.234, 142.250.186.74, 172.217.18.10, 142.250.185.106, 216.58.206.74, 142.250.181.227, 142.250.184.238, 142.250.185.206, 184.28.90.27, 52.149.20.212, 4.245.163.56, 13.107.246.45
                                                                                                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                      • VT rate limit hit for: https://dtrnconsulta.com/hnvwk

                                                                                                                                                      Simulations

                                                                                                                                                      Behavior and APIs

                                                                                                                                                      ⊘No simulations