Edit tour

Windows Analysis Report
http://geminiloguiin.godaddysites.com/

Overview

General Information

Sample URL:	http://geminiloguiin.godaddysites.com/
Analysis ID:	1621615
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish64

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2032,i,4204057926440784406,7398255935624915065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://geminiloguiin.godaddysites.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_HtmlPhish_64	Yara detected HtmlPhish_64	Joe Security

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-22T01:40:10.424461+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49803	2.19.96.250	443	TCP
2025-02-22T01:40:10.584122+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49802	2.19.96.250	443	TCP
2025-02-22T01:40:11.742394+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49813	95.100.110.11	443	TCP
2025-02-22T01:40:12.007609+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49814	95.100.110.11	443	TCP
2025-02-22T01:40:17.112016+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	49822	2.19.96.250	443	TCP

HTTP traffic detected: POST /eventbus/web?clientid=b18ef4f046435b64a469b32c3c1c20a3 HTTP/1.1Host: csp.secureserver.netConnection: keep-aliveContent-Length: 1257sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://geminiloguiin.godaddysites.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://geminiloguiin.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_109.2.dr, chromecache_143.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_96.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: sets.json.0.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.0.dr	String found in binary or memory: https://24.hu
Source: sets.json.0.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://bunsin.io
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.0.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://css-load.com
Source: sets.json.0.dr	String found in binary or memory: https://datasign.jp
Source: sets.json.0.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.0.dr	String found in binary or memory: https://deere.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://drimer.io
Source: sets.json.0.dr	String found in binary or memory: https://drimer.travel
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://geforcenow.com
Source: chromecache_96.2.dr	String found in binary or memory: https://geminiloguiin.godaddysites.com/
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.0.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.0.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.0.dr	String found in binary or memory: https://html-load.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://img-load.com
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.wof
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUjm6bnEr.w
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRFZfX80.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRVZfX80.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRlZfX80.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tS1Zf.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tT1ZfX80.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q-bHNiZg.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q0bHNiZg.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q1bHNiZg.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q3bHNiZg.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVep1q4dHc.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepFq4dHc.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepVq4dHc.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVerlq4dHc.woff2)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.0.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.0.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.0.dr	String found in binary or memory: https://interia.pl
Source: sets.json.0.dr	String found in binary or memory: https://intoday.in
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livechat.com
Source: sets.json.0.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://meo.pt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://naukri.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.0.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://p106.net
Source: sets.json.0.dr	String found in binary or memory: https://p24.hu
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://sapo.io
Source: sets.json.0.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.0.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.0.dr	String found in binary or memory: https://text.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://the42.ie
Source: sets.json.0.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.0.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.0.dr	String found in binary or memory: https://top.pl
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://webtru.io
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.0.dr	String found in binary or memory: https://zoom.com
Source: sets.json.0.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 61730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_2076_1880673306

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@19/107@20/12

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2032,i,4204057926440784406,7398255935624915065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://geminiloguiin.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2032,i,4204057926440784406,7398255935624915065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\LICENSE.txt

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://geminiloguiin.godaddysites.com/	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
e8843.dsca.akamaiedge.net	23.37.42.16	true	false	high
e40258.g.akamaiedge.net	95.101.182.74	true	false	high
geminiloguiin.godaddysites.com	13.248.243.5	true	true	unknown
www.google.com	172.217.18.4	true	false	high
e64861.dsca.akamaiedge.net	2.19.96.250	true	false	high
isteam.wsimg.com	3.121.91.69	true	false	high
img1.wsimg.com	unknown	unknown	false	high
csp.secureserver.net	unknown	unknown	false	high
events.api.secureserver.net	unknown	unknown	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://img1.wsimg.com/gfonts/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2	false	high
https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-linkIndicator-c1af92dd.js	false	high
https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-index3-55bc27af.js	false	high
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2	false	high
https://img1.wsimg.com/signals/js/clients/tti/tti.min.js	false	high
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2	false	high
https://img1.wsimg.com/isteam/ip/2f27a43e-01e9-4831-9035-55c692fc002b/favicon/b03f9530-aeb5-443a-b917-20d8bd5420a6.png/:/rs=w:32,h:32,m	false	high
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js	false	high
https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-loaders-fffeeba5.js	false	high
https://img1.wsimg.com/blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/Carousel-3d82957b.js	false	high
https://geminiloguiin.godaddysites.com/	true	unknown
https://img1.wsimg.com/blobby/go/static/radpack/@widget/LAYOUT/c/bs-modernThinRound-ced97fbd.js	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wieistmeineip.de	sets.json.0.dr	false	high
https://mercadoshops.com.co	sets.json.0.dr	false	high
https://gliadomain.com	sets.json.0.dr	false	high
https://poalim.xyz	sets.json.0.dr	false	high
https://mercadolivre.com	sets.json.0.dr	false	high
https://easylist.to/)	LICENSE.txt.0.dr	false	high
https://reshim.org	sets.json.0.dr	false	high
https://nourishingpursuits.com	sets.json.0.dr	false	high
https://medonet.pl	sets.json.0.dr	false	high
https://unotv.com	sets.json.0.dr	false	high
https://mercadoshops.com.br	sets.json.0.dr	false	high
https://joyreactor.cc	sets.json.0.dr	false	high
https://zdrowietvn.pl	sets.json.0.dr	false	high
https://johndeere.com	sets.json.0.dr	false	high
https://songstats.com	sets.json.0.dr	false	high
https://baomoi.com	sets.json.0.dr	false	high
https://supereva.it	sets.json.0.dr	false	high
https://elfinancierocr.com	sets.json.0.dr	false	high
https://bolasport.com	sets.json.0.dr	false	high
https://rws1nvtvt.com	sets.json.0.dr	false	high
https://desimartini.com	sets.json.0.dr	false	high
https://hearty.app	sets.json.0.dr	false	high
https://hearty.gift	sets.json.0.dr	false	high
https://mercadoshops.com	sets.json.0.dr	false	high
https://heartymail.com	sets.json.0.dr	false	high
https://nlc.hu	sets.json.0.dr	false	high
https://p106.net	sets.json.0.dr	false	high
https://radio2.be	sets.json.0.dr	false	high
https://finn.no	sets.json.0.dr	false	high
https://hc1.com	sets.json.0.dr	false	high
https://kompas.tv	sets.json.0.dr	false	high
https://mystudentdashboard.com	sets.json.0.dr	false	high
https://songshare.com	sets.json.0.dr	false	high
https://smaker.pl	sets.json.0.dr	false	high
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRFZfX80.woff2)	chromecache_96.2.dr	false	high
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q-bHNiZg.woff2)	chromecache_96.2.dr	false	high
https://mercadopago.com.mx	sets.json.0.dr	false	high
https://p24.hu	sets.json.0.dr	false	high
https://talkdeskqaid.com	sets.json.0.dr	false	high
https://24.hu	sets.json.0.dr	false	high
https://mercadopago.com.pe	sets.json.0.dr	false	high
https://cardsayings.net	sets.json.0.dr	false	high
https://text.com	sets.json.0.dr	false	high
https://mightytext.net	sets.json.0.dr	false	high
https://pudelek.pl	sets.json.0.dr	false	high
https://hazipatika.com	sets.json.0.dr	false	high
https://joyreactor.com	sets.json.0.dr	false	high
https://cookreactor.com	sets.json.0.dr	false	high
https://wildixin.com	sets.json.0.dr	false	high
https://eworkbookcloud.com	sets.json.0.dr	false	high
https://cognitiveai.ru	sets.json.0.dr	false	high
https://nacion.com	sets.json.0.dr	false	high
https://chennien.com	sets.json.0.dr	false	high
https://drimer.travel	sets.json.0.dr	false	high
https://deccoria.pl	sets.json.0.dr	false	high
https://mercadopago.cl	sets.json.0.dr	false	high
https://talkdeskstgid.com	sets.json.0.dr	false	high
https://naukri.com	sets.json.0.dr	false	high
https://interia.pl	sets.json.0.dr	false	high
https://bonvivir.com	sets.json.0.dr	false	high
https://carcostadvisor.be	sets.json.0.dr	false	high
https://salemovetravel.com	sets.json.0.dr	false	high
https://sapo.io	sets.json.0.dr	false	high
https://wpext.pl	sets.json.0.dr	false	high
https://welt.de	sets.json.0.dr	false	high
https://poalim.site	sets.json.0.dr	false	high
https://drimer.io	sets.json.0.dr	false	high
https://infoedgeindia.com	sets.json.0.dr	false	high
https://blackrockadvisorelite.it	sets.json.0.dr	false	high
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRVZfX80.woff2)	chromecache_96.2.dr	false	high
https://cognitive-ai.ru	sets.json.0.dr	false	high
https://cafemedia.com	sets.json.0.dr	false	high
https://graziadaily.co.uk	sets.json.0.dr	false	high
https://thirdspace.org.au	sets.json.0.dr	false	high
https://mercadoshops.com.ar	sets.json.0.dr	false	high
https://smpn106jkt.sch.id	sets.json.0.dr	false	high
https://elpais.uy	sets.json.0.dr	false	high
https://landyrev.com	sets.json.0.dr	false	high
https://the42.ie	sets.json.0.dr	false	high
https://commentcamarche.com	sets.json.0.dr	false	high
https://tucarro.com.ve	sets.json.0.dr	false	high
https://rws3nvtvt.com	sets.json.0.dr	false	high
https://eleconomista.net	sets.json.0.dr	false	high
https://helpdesk.com	sets.json.0.dr	false	high
https://mercadolivre.com.br	sets.json.0.dr	false	high
https://clmbtech.com	sets.json.0.dr	false	high
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q3bHNiZg.woff2)	chromecache_96.2.dr	false	high
https://standardsandpraiserepurpose.com	sets.json.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.121.91.69	isteam.wsimg.com	United States	16509	AMAZON-02US	false
95.100.110.11	unknown	European Union	20940	AKAMAI-ASN1EU	false
142.250.185.228	unknown	United States	15169	GOOGLEUS	false
13.248.243.5	geminiloguiin.godaddysites.com	United States	16509	AMAZON-02US	true
23.37.42.16	e8843.dsca.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
2.19.96.250	e64861.dsca.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
95.101.182.82	unknown	European Union	20940	AKAMAI-ASN1EU	false
95.101.182.74	e40258.g.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1621615
Start date and time:	2025-02-22 01:39:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://geminiloguiin.godaddysites.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@19/107@20/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.185.78, 173.194.76.84, 142.250.186.174, 142.250.186.142, 216.58.206.42, 142.250.185.227, 199.232.210.172, 2.23.77.188, 142.250.185.142, 142.250.186.110, 142.250.185.238, 216.58.206.78, 216.58.206.67, 34.104.35.123, 2.19.106.160, 172.202.163.200, 13.85.23.206, 13.107.246.60
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://geminiloguiin.godaddysites.com/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	75385
Entropy (8bit):	5.5362778400961234
Encrypted:	false
SSDEEP:	1536:mA9s0XZjhGQQlppnSLk3riDXgg60rvQY0sMIUvECt/SvOz2S6rVz:75JjAQyppsk3rIXgg60zQY0sMIJCt/TK
MD5:	7C91E14B081C346267E1B1761C029F1C
SHA1:	40D2665FD0042A5AAA3B8C7C451813D6C7005EAD
SHA-256:	FD3ADE759BD847F845FE201167DE1F53E53A2275631303952F1AC4D7AB5B19DC
SHA-512:	89A269667034FC15E7ECDC3AEC70375949C1AE65A944CB3D762909152C8DB1C4B163AA2162698A0345889154E248B5A70B7C93182F5A853529EEFD889926233D
Malicious:	false
Reputation:	low
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.just-news.pro^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.abh.jp^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R.adrecover.com^..........0.8.@.R.pemsrv.com^..........0.8.@.R.mnaspm.com^.$........0.8.@.R.tags.refinery89.com^.,........0.8.@.R.mysmth.net/nForum//ADAgent_.>...........worldstar.com0.8.@.R.js.assemblyexchange.com/wana..(........0.8.@.R.ogads-pa.googleapis.com^..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^.(........0.8.@.R.shikoku-np.co.jp/img/ad/..........0.8.@.R./banner.cgi?..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.clicktripz.com^..........0.8.@.R.-ad-manager/........0.8.@.R.files.slack.com^.$........0.8.@.R.admitad-connect.com^..........0.8.@.R./300-250-.2........0.8.@.R"cloudfront.net/js/common

Source: http://geminiloguiin.godaddysites.com	Joe Sandbox AI: The URL 'geminiloguiin.godaddysites.com' appears to be attempting to spoof the known cryptocurrency exchange brand 'Gemini'. The subdomain 'geminiloguiin' is visually similar to 'geminilogin', which could confuse users attempting to access the legitimate Gemini login page. The use of 'godaddysites.com' as the main domain suggests a free website hosting service, which is often used for typosquatting attempts. The structural similarity and the use of a common brand name in the subdomain increase the likelihood of this being a typosquatting attempt. However, the presence of 'godaddysites.com' as the main domain could also indicate a non-deceptive use, but given the context and similarity, it is more likely to be an attempt to deceive users.
Source: https://geminiloguiin.godaddysites.com	Joe Sandbox AI: The URL 'geminiloguiin.godaddysites.com' appears to be attempting to mimic the legitimate brand 'Gemini', a known cryptocurrency exchange. The subdomain 'geminiloguiin' is visually similar to 'geminilogin', which could confuse users attempting to access their Gemini accounts. The use of 'godaddysites.com' as the main domain suggests a free website hosting service, which is often used for typosquatting or phishing attempts. The structural similarity and the use of a common brand name in the subdomain increase the likelihood of this being a typosquatting attempt. However, the presence of 'godaddysites.com' indicates that this could also be a non-deceptive use of a free hosting service, but the context and similarity suggest a high likelihood of confusion.

Source: global traffic	TCP traffic: 192.168.2.4:61713 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:57174 -> 162.159.36.2:53

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:49803 -> 2.19.96.250:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:49813 -> 95.100.110.11:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:49814 -> 95.100.110.11:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:49822 -> 2.19.96.250:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:49802 -> 2.19.96.250:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: geminiloguiin.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 22, 2025 01:39:56.893904924 CET	53	60186	1.1.1.1	192.168.2.4
Feb 22, 2025 01:39:56.910969019 CET	53	56109	1.1.1.1	192.168.2.4
Feb 22, 2025 01:39:57.902609110 CET	53	64393	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:00.616445065 CET	51949	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:00.616630077 CET	56147	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:00.623538971 CET	53	51949	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:00.623733997 CET	53	56147	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:02.486608028 CET	61692	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:02.487015009 CET	60798	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:02.496066093 CET	53	61692	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:02.500066042 CET	53	60798	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:02.985090971 CET	60772	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:02.985668898 CET	58618	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:02.995049000 CET	53	60772	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:02.996442080 CET	53	58618	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:03.647610903 CET	61824	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:03.647841930 CET	60155	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:03.655962944 CET	53	60155	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:03.656290054 CET	53	61824	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:03.742693901 CET	51144	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:03.742944956 CET	52399	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:03.746085882 CET	53	51201	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:03.753473043 CET	53	52399	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:03.761702061 CET	53	51144	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:04.876636982 CET	54246	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:04.876784086 CET	53827	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:04.884851933 CET	53	54246	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:04.888626099 CET	53	53827	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:09.183079004 CET	55029	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:09.183279991 CET	53540	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:09.190618992 CET	53	55029	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:09.197345972 CET	53	53540	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:09.431792974 CET	61795	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:09.432079077 CET	56314	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:09.441271067 CET	53	61795	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:09.443207979 CET	53	56314	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:10.431586027 CET	52733	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:10.431874037 CET	49279	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:10.439327955 CET	53	49279	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:10.439344883 CET	53	52733	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:13.950728893 CET	138	138	192.168.2.4	192.168.2.255
Feb 22, 2025 01:40:14.889607906 CET	53	54155	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:27.466187954 CET	53	63338	162.159.36.2	192.168.2.4
Feb 22, 2025 01:40:27.964148045 CET	59953	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:40:27.974934101 CET	53	59953	1.1.1.1	192.168.2.4
Feb 22, 2025 01:40:58.185614109 CET	53	54315	1.1.1.1	192.168.2.4
Feb 22, 2025 01:41:00.679415941 CET	54264	53	192.168.2.4	1.1.1.1
Feb 22, 2025 01:41:00.686868906 CET	53	54264	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Feb 22, 2025 01:40:02.506715059 CET	445	OUT	GET / HTTP/1.1 Host: geminiloguiin.godaddysites.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 22, 2025 01:40:02.981827021 CET	356	IN	HTTP/1.1 301 Moved Permanently location: https://geminiloguiin.godaddysites.com/ vary: Accept-Encoding server: DPS/2.0.0+sha-999b56c x-version: 999b56c x-siteid: us-east-1 set-cookie: dps_site_id=us-east-1; path=/ etag: 4040083a8d64b824469887cceb389517 date: Sat, 22 Feb 2025 00:40:02 GMT keep-alive: timeout=5 transfer-encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:03 UTC	704	OUT	GET / HTTP/1.1 Host: geminiloguiin.godaddysites.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1
2025-02-22 00:40:03 UTC	1383	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.5.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tS1Zf.woff2>; rel=preload; as=font; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-999b56c X-Version: 999b56c X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 4040083a8d64b824469887cceb389517 Date: Sat, 22 Feb 2025 00:40:03 GMT Connection: close Transfer-Encoding: chunked
2025-02-22 00:40:03 UTC	15001	IN	Data Raw: 36 37 32 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 32 66 32 37 61 34 33 65 2d 30 31 65 39 2d 34 38 33 31 2d 39 30 33 35 2d 35 35 63 36 39 32 66 63 30 30 32 62 2f 66 61 76 69 63 6f 6e 2f 62 30 33 66 39 35 33 30 2d 61 65 62 35 2d 34 34 33 61 2d 62 39 31 37 2d 32 30 64 38 62 64 35 34 32 30 61 36 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f Data Ascii: 672c<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/2f27a43e-01e9-4831-9035-55c692fc002b/favicon/b03f9530-aeb5-443a-b917-20d8bd5420a6.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/
2025-02-22 00:40:03 UTC	11424	IN	Data Raw: 37 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 2c 2e 36 38 2c 2e 31 38 2c 31 2e 30 38 29 20 2d 2e 32 34 73 20 69 6e 66 69 6e 69 74 65 7d 2e 78 2d 6c 6f 61 64 65 72 20 73 76 67 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 73 63 61 6c 65 20 2e 37 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 2c 2e 36 38 2c 2e 31 38 2c 31 2e 30 38 29 20 2d 2e 31 32 73 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6c 6f 61 64 65 72 73 63 61 6c 65 20 2e 37 35 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 2c 2e 36 38 2c 2e 31 38 2c 31 2e 30 38 29 20 2d 2e 31 32 73 20 69 6e 66 69 6e 69 74 65 7d 2e 78 2d 6c 6f 61 64 65 72 20 73 76 67 3a 6e 74 68 2d 63 68 69 6c 64 28 33 29 7b Data Ascii: 75s cubic-bezier(.2,.68,.18,1.08) -.24s infinite}.x-loader svg:nth-child(2){-webkit-animation:loaderscale .75s cubic-bezier(.2,.68,.18,1.08) -.12s infinite;animation:loaderscale .75s cubic-bezier(.2,.68,.18,1.08) -.12s infinite}.x-loader svg:nth-child(3){

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:04 UTC	637	OUT	GET /ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.5.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:04 UTC	708	IN	HTTP/1.1 200 OK Content-Type: application/javascript x-version: 0.7.3+sha-a7223ca ETag: "31e273e89fb56a44d86d206f1bcdcdb4" Last-Modified: Wed, 09 Nov 2022 17:28:26 GMT x-amzn-trace-id: Root=1-636be339-1e3f8f232a9278302e78dad0 x-forwarded-port: 443 X-Forwarded-For: 64.202.160.109 x-forwarded-proto: https Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:04 GMT Date: Sat, 22 Feb 2025 00:40:04 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:04 UTC	15676	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 76 61 72 20 43 6f 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 74 5b 72 5d 29 72 65 74 75 72 6e 20 74 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 74 5b 72 5d 3d 7b 69 3a 72 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 6e 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6e 2e 6d 3d 65 2c 6e 2e 63 3d 74 2c 6e 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 6e 2e 6f 28 65 2c 74 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 65 6e 75 6d 65 Data Ascii: 00006000var Core=function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}return n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)\|\|Object.defineProperty(e,t,{enume
2025-02-22 00:40:04 UTC	8912	IN	Data Raw: 65 72 28 74 3d 3d 3d 4c 74 3f 65 2e 6c 65 6e 67 74 68 2d 31 3a 74 2c 30 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 72 3d 61 72 67 75 6d 65 6e 74 73 2c 6f 3d 2d 31 2c 61 3d 65 72 28 72 2e 6c 65 6e 67 74 68 2d 74 2c 30 29 2c 6c 3d 41 72 72 61 79 28 61 29 3b 2b 2b 6f 3c 61 3b 29 6c 5b 6f 5d 3d 72 5b 74 2b 6f 5d 3b 66 6f 72 28 6f 3d 2d 31 2c 61 3d 41 72 72 61 79 28 74 2b 31 29 3b 2b 2b 6f 3c 74 3b 29 61 5b 6f 5d 3d 72 5b 6f 5d 3b 72 65 74 75 72 6e 20 61 5b 74 5d 3d 6e 28 6c 29 2c 69 28 65 2c 74 68 69 73 2c 61 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 74 29 7b 69 66 28 28 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 21 3d 3d 74 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 5b 74 5d 29 26 26 22 5f 5f 70 72 6f 74 6f 5f Data Ascii: er(t===Lt?e.length-1:t,0),function(){for(var r=arguments,o=-1,a=er(r.length-t,0),l=Array(a);++o<a;)l[o]=r[t+o];for(o=-1,a=Array(t+1);++o<t;)a[o]=r[o];return a[t]=n(l),i(e,this,a)}}function Ue(e,t){if(("constructor"!==t\|\|"function"!=typeof e[t])&&"__proto_
2025-02-22 00:40:04 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6f 62 6a 65 63 74 20 45 72 72 6f 72 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 46 75 6e 63 74 69 6f 6e 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 4d 61 70 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 4e 75 6d 62 65 72 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 52 65 67 45 78 70 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 53 65 74 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 53 74 72 69 6e 67 5d 22 5d 3d 63 6e 5b 22 5b 6f 62 6a 65 63 74 20 57 65 61 6b 4d 61 70 5d 22 5d 3d 21 31 3b 76 61 72 20 66 6e 3d 7b 7d 3b 66 6e 5b 22 5b 6f 62 6a 65 63 74 20 41 72 67 75 6d 65 6e 74 73 5d 22 5d 3d 66 6e 5b 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d Data Ascii: 00006000object Error]"]=cn["[object Function]"]=cn["[object Map]"]=cn["[object Number]"]=cn["[object Object]"]=cn["[object RegExp]"]=cn["[object Set]"]=cn["[object String]"]=cn["[object WeakMap]"]=!1;var fn={};fn["[object Arguments]"]=fn["[object Array]
2025-02-22 00:40:04 UTC	8204	IN	Data Raw: 7d 2c 6f 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 26 26 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 3b 66 6f 72 28 76 61 72 20 61 20 69 6e 20 65 29 69 66 28 22 64 65 66 61 75 6c 74 22 21 3d 3d 61 26 26 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 61 29 29 7b 76 61 72 20 69 3d 6f 3f 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 61 29 3a 6e 75 6c 6c 3b 69 26 26 28 69 2e 67 65 74 7c 7c 69 2e 73 65 74 29 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 72 2c 61 2c 69 29 3a 72 5b 61 5d 3d 65 5b 61 5d 7d 72 2e 64 65 66 61 75 6c 74 3d 65 2c 6e Data Ascii: },o=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var a in e)if("default"!==a&&Object.prototype.hasOwnProperty.call(e,a)){var i=o?Object.getOwnPropertyDescriptor(e,a):null;i&&(i.get\|\|i.set)?Object.defineProperty(r,a,i):r[a]=e[a]}r.default=e,n
2025-02-22 00:40:04 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6f 75 70 22 3a 22 67 72 6f 75 70 22 2c 22 66 69 65 6c 64 2d 69 64 22 3a 22 66 69 65 6c 64 22 2c 22 66 69 65 6c 64 2d 72 6f 75 74 65 22 3a 22 72 6f 75 74 65 22 7d 2c 43 3d 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 28 7b 66 6f 6e 74 44 69 61 6c 73 3a 4f 2e 64 69 61 6c 73 2e 66 6f 6e 74 44 69 61 6c 73 2c 63 6f 6c 6f 72 44 69 61 6c 73 3a 4f 2e 64 69 61 6c 73 2e 63 6f 6c 6f 72 44 69 61 6c 73 2c 74 68 65 6d 65 4f 76 65 72 72 69 64 65 73 3a 4f 2e 74 68 65 6d 65 2e 6f 76 65 72 72 69 64 65 73 7d 29 2e 63 6f 6e 63 61 74 28 5f 2e 73 65 6c 65 63 74 6f 72 4d 61 70 45 6e 74 72 69 65 73 29 3b 74 2e 73 65 6c 65 63 74 6f 72 4d 61 70 45 6e 74 72 69 65 73 3d 43 3b 63 6f 6e 73 74 20 52 3d 65 3d 3e 28 30 2c 69 2e 74 72 61 6e 73 66 6f 72 6d 29 28 Data Ascii: 00004000oup":"group","field-id":"field","field-route":"route"},C=Object.entries({fontDials:O.dials.fontDials,colorDials:O.dials.colorDials,themeOverrides:O.theme.overrides}).concat(_.selectorMapEntries);t.selectorMapEntries=C;const R=e=>(0,i.transform)(
2025-02-22 00:40:04 UTC	12	IN	Data Raw: 76 6f 69 64 20 30 3b 76 61 72 0d 0a Data Ascii: void 0;var
2025-02-22 00:40:04 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 20 72 3d 6e 28 31 33 29 2c 6f 3d 6e 28 39 29 3b 63 6f 6e 73 74 20 61 3d 28 30 2c 6f 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 53 65 6c 65 63 74 6f 72 29 28 22 66 6f 6e 74 73 22 2c 5b 5d 29 3b 74 2e 66 6f 6e 74 73 3d 61 3b 63 6f 6e 73 74 20 69 3d 28 30 2c 6f 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 53 65 6c 65 63 74 6f 72 29 28 22 63 6f 6c 6f 72 73 22 2c 5b 5d 29 3b 74 2e 63 6f 6c 6f 72 73 3d 69 3b 63 6f 6e 73 74 20 6c 3d 28 30 2c 6f 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 53 65 6c 65 63 74 6f 72 29 28 22 66 6f 6e 74 53 63 61 6c 65 22 2c 22 6d 65 64 69 75 6d 22 29 3b 74 2e 66 6f 6e 74 53 63 61 6c 65 3d 6c 3b 63 6f 6e 73 74 20 75 3d 28 30 2c 6f 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 53 65 6c 65 63 74 6f 72 29 28 22 6c 6f Data Ascii: 00004000 r=n(13),o=n(9);const a=(0,o.createContextSelector)("fonts",[]);t.fonts=a;const i=(0,o.createContextSelector)("colors",[]);t.colors=i;const l=(0,o.createContextSelector)("fontScale","medium");t.fontScale=l;const u=(0,o.createContextSelector)("lo
2025-02-22 00:40:04 UTC	12	IN	Data Raw: 2c 74 68 69 73 2e 5f 6d 65 74 0d 0a Data Ascii: ,this._met
2025-02-22 00:40:04 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 4f 76 65 72 72 69 64 65 73 5b 6e 5d 7d 6d 61 70 53 74 79 6c 65 73 28 65 3d 7b 7d 2c 74 3d 7b 7d 2c 6e 29 7b 74 3d 7b 64 65 76 69 63 65 3a 61 2e 58 53 4d 41 4c 4c 2c 61 70 70 6c 79 4d 65 74 61 53 74 79 6c 65 73 3a 21 30 2c 66 61 6d 69 6c 79 3a 65 2e 66 6f 6e 74 46 61 6d 69 6c 79 2c 2e 2e 2e 74 7d 2c 6e 3d 6e 7c 7c 74 68 69 73 2e 67 65 74 4d 65 74 61 57 69 74 68 4f 76 65 72 72 69 64 65 73 28 74 29 3b 63 6f 6e 73 74 20 72 3d 74 2e 64 65 76 69 63 65 3d 3d 3d 61 2e 58 53 4d 41 4c 4c 2c 75 3d 74 2e 61 70 70 6c 79 4d 65 74 61 53 74 79 6c 65 73 26 26 72 26 26 74 68 69 73 2e 67 65 74 28 74 2e 66 61 6d 69 6c 79 2b 22 2e 73 74 79 6c 65 73 22 2c 6e 75 6c 6c 2c 6e 29 3b 6c 65 74 20 73 3b 69 66 28 73 3d 74 2e 75 73 65 46 6f 6e 74 44 65 Data Ascii: 00004000aOverrides[n]}mapStyles(e={},t={},n){t={device:a.XSMALL,applyMetaStyles:!0,family:e.fontFamily,...t},n=n\|\|this.getMetaWithOverrides(t);const r=t.device===a.XSMALL,u=t.applyMetaStyles&&r&&this.get(t.family+".styles",null,n);let s;if(s=t.useFontDe
2025-02-22 00:40:04 UTC	12	IN	Data Raw: 3d 3d 6f 3f 28 6e 2e 70 75 73 0d 0a Data Ascii: ==o?(n.pus

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:04 UTC	650	OUT	GET /gfonts/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2 HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:04 UTC	752	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Content-Length: 24364 X-Content-Type-Options: nosniff X-XSS-Protection: 0 Last-Modified: Wed, 27 Sep 2023 15:41:12 GMT Content-Type: font/woff2 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:04 GMT Date: Sat, 22 Feb 2025 00:40:04 GMT Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:04 UTC	15632	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 5f 2c 00 15 00 00 00 00 b4 44 00 00 5e b6 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 6d 1b ab 08 1c 86 48 3f 48 56 41 52 83 55 3f 4d 56 41 52 45 06 60 3f 53 54 41 54 81 00 27 22 00 84 34 2f 4c 11 08 0a 81 8b 3c f2 6d 0b 84 30 00 30 fd 32 01 36 02 24 03 88 5c 04 20 05 85 28 07 89 52 0c 07 1b 56 a4 35 ca b6 4f 25 c8 ed 00 e2 ff dc 7f fa 91 08 61 e3 c0 20 8c 22 67 23 2c d8 38 80 36 b6 6f 9f fc ff df 93 0e 19 1b 64 1b 00 f7 4f 33 a4 11 83 5e 28 a5 28 66 50 dd c8 61 a5 b0 aa a2 c2 34 32 33 7b a8 e8 9b 08 11 b7 d9 90 2c 87 72 49 73 96 27 85 46 d4 64 7a 37 6d 82 b8 97 c8 b0 3f f7 a9 a8 b3 97 99 ef 2d 54 ad 31 ef d7 6d 2d 67 eb 8f b1 ef 0e c8 a3 df 97 b7 33 86 36 e9 3e fc 88 b6 1d 1a 5d 73 0e 1f 33 Data Ascii: wOF2_,D^mH?HVARU?MVARE`?STAT'"4/L<m0026$\ (RV5O%a "g#,86odO3^((fPa423{,rIs'Fdz7m?-T1m-g36>]s3
2025-02-22 00:40:04 UTC	8732	IN	Data Raw: 94 28 a2 09 74 32 27 45 b2 c3 7c d8 6b d0 6b cd 58 37 2c 10 34 1e 8b ae 5b ea 39 67 b1 68 0e 66 0c a3 e0 c1 38 24 58 0b ee a9 98 6f b9 9c 24 54 2f 78 e8 e9 42 ed 63 09 75 c3 f8 2d ad 1e 97 b0 c2 a6 10 f6 c7 b8 e1 96 29 76 95 81 97 f7 b6 d3 62 4e 3c 70 5f 24 4b 28 81 5e 37 47 b5 2c 4f 5b 91 51 e7 9e da 52 a5 a1 58 95 31 16 51 37 dc 0e 18 16 9a d8 6d 2a d1 2f b0 21 30 aa 2a 50 3a 51 44 6b e5 af f6 d4 b5 d5 f6 1b d4 ad a2 71 1c 59 d6 de 34 5a 67 91 f6 e0 41 c6 27 cb be 2b b7 8a 4c 4d 2a 25 72 6e 59 31 8f a6 d6 b2 c1 27 b6 7d 53 cf 84 5e 67 02 2d 47 46 38 77 f6 0e e0 dc 31 c3 2a 04 8b c5 9b 4a 0f 3f c4 83 a4 73 2b a9 94 0e 1a f4 28 86 ab 8c 84 1e c9 93 c6 2c d2 ad 14 25 84 b2 78 5e 1a 99 32 cd 76 fe ba b6 9f 4c 7a d2 f3 cd 13 87 f3 eb ad c3 4c 07 8f 42 08 2e Data Ascii: (t2'E\|kkX7,4[9ghf8$Xo$T/xBcu-)vbN<p_$K(^7G,O[QRX1Q7m/!0P:QDkqY4ZgA'+LM%rnY1'}S^g-GF8w1J?s+(,%x^2vLzLB.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Reputation:	low
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:04 UTC	639	OUT	GET /gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2 HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:04 UTC	752	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Content-Length: 25548 X-Content-Type-Options: nosniff X-XSS-Protection: 0 Last-Modified: Thu, 24 Aug 2023 17:46:03 GMT Content-Type: font/woff2 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:04 GMT Date: Sat, 22 Feb 2025 00:40:04 GMT Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:04 UTC	15632	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 63 cc 00 11 00 00 00 01 18 28 00 00 63 67 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 74 1b 8e 3a 1c 86 4e 06 60 00 85 2c 08 81 42 09 9a 16 11 08 0a 83 da 40 83 9e 14 0b 84 1c 00 01 36 02 24 03 88 34 04 20 05 83 7a 07 88 60 0c 81 31 1b b4 f6 55 07 62 d8 38 00 20 e6 64 77 51 94 6a da 3a 47 06 f2 38 40 72 35 2a fa ff 94 a4 63 0c 37 ea 03 34 ad 9b 9a 2d f7 10 67 a9 61 38 44 29 5c 51 5b 36 a1 24 fa 9d 94 89 16 29 a4 cc bc 9f 3f dc 18 2f c4 c1 62 b1 44 13 89 78 cd 3c 69 d8 d7 cf 2e 9a fb a3 38 9e a2 29 12 ef f1 21 38 0c 1d 2e 5a 14 b4 3e eb 49 b7 7a 73 33 c4 12 86 ac 56 dd ea 98 be c4 9a 92 b9 2d d7 eb ce 42 85 78 cb cf 3e 03 db 46 fe 24 27 ef 11 cd f9 3f b3 77 31 ad 05 6a 87 79 ac 10 b4 21 04 fc b5 Data Ascii: wOF2c(cgt:N`,B@6$4 z`1Ub8 dwQj:G8@r5*c74-ga8D)\Q[6$)?/bDx<i.8)!8.Z>Izs3V-Bx>F$'?w1jy!
2025-02-22 00:40:04 UTC	8944	IN	Data Raw: 1a 4c cf 5d 9d 70 62 5c 8a fc 81 4c 2f a1 cb 2d 30 f7 60 c2 99 71 f1 f2 6a 05 05 64 e9 97 1c 2b d9 91 95 9e 66 56 e6 f5 ad 92 10 f8 7b d7 32 57 9e 50 bd 51 34 39 40 28 08 c6 eb ed 9f fc d7 03 91 c6 85 21 6d 80 e8 a0 46 3d 0b 60 6d 1d 44 16 ae 2f 49 1a 0b fc 5b 58 06 af cf 11 49 97 c8 87 b7 39 7d 28 60 3c 06 3b a4 dc 0e 96 f2 54 d1 2c 11 e3 40 24 de 07 97 c7 71 f8 05 90 b8 54 e0 54 7c 80 f9 a0 c6 82 08 91 6e 5d 54 17 de 17 c7 7b fa b7 b0 0c 51 16 71 61 e4 01 7a d5 ce 2e 2f e6 16 f2 d5 bc 8b 1a 26 37 75 70 f8 c7 f8 e6 d9 4d ca 75 9d b2 d6 26 8f 69 ed 19 7c 49 da 35 aa 4b 30 97 99 90 81 46 1a 14 6d 0a 78 cc 02 f2 69 5d 54 63 1b 10 b1 68 e0 12 fe 2d 2c df 8f 86 a3 a9 21 6b a6 75 9e 1d fa fa ef 80 cb 61 0b 4c 2e db a6 2e d3 44 0a 04 1e 5e ce be b7 59 b6 8b 89 Data Ascii: L]pb\L/-0`qjd+fV{2WPQ49@(!mF=`mD/I[XI9}(`<;T,@$qTT\|n]T{Qqaz./&7upMu&i\|I5K0Fmxi]Tch-,!kuaL..D^Y
2025-02-22 00:40:04 UTC	972	IN	Data Raw: 87 a3 47 ad 10 52 75 1e 0d f5 ad 85 39 a0 e3 65 b6 b5 9e 24 cd ee f8 96 77 42 48 24 37 b3 ad 12 79 37 c0 6c b0 3d 93 e6 83 d1 4b ca 80 ad ea 2b 13 89 f3 b6 f5 c2 99 c8 80 eb 85 82 bd b5 39 17 67 1d 81 00 1b 58 45 61 1f 16 42 2d 4c 23 80 b3 4d d7 28 08 80 ab 00 05 6b 1e 00 34 c4 57 f3 50 2f 6f e6 11 42 96 79 94 10 8b e7 d1 3c d5 cd 63 b1 65 9a c7 e6 4a 2b 8b 75 07 40 11 f3 3c b7 4a 00 9f ee 35 72 55 2b 8e 65 b3 aa f7 56 23 97 ed 72 65 52 2e cc 77 ef 2f 42 9c fe dd 75 cf 33 88 59 b6 0a 79 b2 55 cb 93 20 81 97 68 25 97 d5 cd cd 95 24 1f 25 e4 4a 59 4f 86 86 37 65 43 05 86 66 b4 ca 2c fd 98 5c d6 87 92 40 f1 0a 84 cb 13 e8 83 cd 2c c4 a9 1a 36 fd 47 75 48 f8 6a 61 5c 12 0c b5 b2 54 54 84 60 02 f2 5d 4a 24 e2 55 6b b9 44 a4 e6 72 13 a1 6a 95 5a 14 3b b9 a6 93 Data Ascii: GRu9e$wBH$7y7l=K+9gXEaB-L#M(k4WP/oBy<ceJ+u@<J5rU+eV#reR.w/Bu3YyU h%$%JYO7eCf,\@,6GuHja\TT`]J$UkDrjZ;

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:04 UTC	636	OUT	GET /gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2 HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:04 UTC	752	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Content-Length: 23676 X-Content-Type-Options: nosniff X-XSS-Protection: 0 Last-Modified: Thu, 24 Aug 2023 18:01:23 GMT Content-Type: font/woff2 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:04 GMT Date: Sat, 22 Feb 2025 00:40:04 GMT Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:04 UTC	15632	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 5c 7c 00 11 00 00 00 00 fe 78 00 00 5c 1a 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 74 1b 91 62 1c 87 06 06 60 00 85 34 08 81 42 09 9a 16 11 08 0a 83 a3 20 82 f0 26 0b 84 1c 00 01 36 02 24 03 88 34 04 20 05 84 02 07 88 60 0c 81 31 1b b6 e1 35 63 dc cd d8 e3 00 6c 62 b7 e3 e0 38 0f 1b 07 01 8f f9 4b 39 3a 10 33 c6 61 00 1e 8d 2a f9 ff 4f 49 2a 72 98 14 69 3a 1b e3 38 14 65 66 e0 44 39 28 a3 99 77 a3 f7 d1 aa 09 79 88 6c d8 6c 41 a2 f4 39 0f 8c 20 2f 88 cd 62 b1 06 ed 68 70 86 1d b5 46 f1 1d 9c d4 82 d6 7a a4 1f 46 34 ef dc 86 af a9 48 50 74 6f e6 e1 8b b5 de 4b 7a f0 22 a7 54 e2 44 2d fc fe 9a b3 e8 eb 1f 6b 5c 0e a5 b0 2a 17 48 f4 21 39 b9 0b e7 41 7e a5 78 ec 48 d8 33 93 f5 08 c9 a7 5d 8b 7f Data Ascii: wOF2\\|x\tb`4B &6$4 `15clb8K9:3aOIri:8efD9(wyllA9 /bhpFzF4HPtoKz"TD-k\*H!9A~xH3]
2025-02-22 00:40:04 UTC	8044	IN	Data Raw: b3 44 a2 76 18 5f 58 68 48 e8 d2 b5 8d 84 07 00 58 26 8d eb bf 45 37 75 97 49 be 70 d8 20 6f b5 84 61 dc 35 2f 10 9a 54 33 af 0a ae 82 a8 50 54 f6 4e ca 42 c6 71 bf 55 dd 86 9e 31 d7 70 9c c0 af d0 a8 a7 46 18 7e 63 3e 6c 36 f2 30 02 a2 99 4c c0 89 14 b0 86 7d ee 31 5b 99 68 1a 8a 0e 04 bc 87 b5 0c 2f b4 af 02 3c 14 b3 58 58 31 c9 e7 a4 d7 1e ee 63 77 88 fc 73 43 5a 56 0d 94 5c 40 0f b1 86 ba 2d 64 2e bc 3f 29 51 30 0d 30 69 84 30 97 3e 56 62 ce bd 9f 51 58 50 6c 68 73 cf 24 a0 4a 2b df 6d c7 2f 29 b6 a6 e8 98 c3 74 ed 71 f0 1e f7 03 c4 b2 99 34 c2 c5 4e bc 64 4f 96 7d dc 01 8b e3 fe a2 f0 18 29 91 25 16 70 f6 41 73 d6 82 22 4c 04 77 ff 2e 0d 90 08 79 58 ae 9c ff 98 8e ee 46 34 c7 02 90 6d 84 68 51 1c e5 08 07 3a d5 6b 93 d2 7f 11 a8 0c 90 e6 12 97 b8 57 Data Ascii: Dv_XhHX&E7uIp oa5/T3PTNBqU1pF~c>l60L}1[h/<XX1cwsCZV\@-d.?)Q00i0>VbQXPlhs$J+m/)tq4NdO})%pAs"Lw.yXF4mhQ:kW

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:04 UTC	640	OUT	GET /gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tS1Zf.woff2 HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:04 UTC	752	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Content-Length: 23992 X-Content-Type-Options: nosniff X-XSS-Protection: 0 Last-Modified: Thu, 24 Aug 2023 17:45:48 GMT Content-Type: font/woff2 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:04 GMT Date: Sat, 22 Feb 2025 00:40:04 GMT Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:04 UTC	15632	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 5d b8 00 11 00 00 00 01 0d 6c 00 00 5d 55 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 74 1b 92 04 1c 87 06 06 60 00 85 34 08 81 42 09 9a 16 11 08 0a 83 c1 0c 83 8e 0d 0b 84 1c 00 01 36 02 24 03 88 34 04 20 05 83 6a 07 88 60 0c 81 31 1b a7 f0 35 78 f3 d0 2a b7 03 cf ce c7 65 6f 31 12 21 63 1c 0c b0 11 83 1b 19 08 36 0e 08 f0 3f 07 2a fe ff 33 12 64 c8 61 3e b8 b4 05 ab d9 3c 89 21 28 86 82 69 51 7a 8f 7a 57 4c a2 0c 4a c3 36 b5 9d ba d3 29 a0 03 13 06 f6 6c 11 a2 00 05 ed 28 18 c4 55 c7 bd eb 34 f9 88 da 2a 15 3f d5 95 61 59 69 da e7 bb d9 ab a6 e2 27 05 16 51 b8 f5 aa 29 60 58 7c 1d e0 7f d4 9c 6f 7a 65 a2 d4 cc 36 36 30 cc c0 f5 6b 9b b7 79 cb 69 fe 36 b0 f0 59 ef 0c 6c 1b f9 93 9c bc 3f d0 dc Data Ascii: wOF2]l]Ut`4B6$4 j`15xeo1!c6?3da><!(iQzzWLJ6)l(U4*?aYi'Q)`X\|oze660kyi6Yl?
2025-02-22 00:40:04 UTC	8360	IN	Data Raw: 3e 17 67 f9 dc c6 a3 92 33 e0 f9 6c f4 cc 4e 7b 7e 64 9a 1e 36 a9 e3 5d f7 b7 80 32 dc 02 30 23 ee f3 f1 60 d5 d7 0e c3 0d 48 f5 fe ac a4 89 86 ae f5 38 6a 29 f6 53 b6 45 e6 32 5b dc 44 c9 bd 35 64 ab f2 29 c7 2f cf 27 a3 40 60 50 f8 8d 1b f1 8a 89 04 32 cc c9 c8 dd e2 47 a6 f6 ae d1 aa 4f d0 ac 41 97 a9 c1 97 93 c8 df 01 55 66 8c 44 9c 89 61 da e4 2b 6c 9d 88 f6 7b 67 91 93 5a fe 83 bf 7e 29 63 86 72 e7 76 dd 28 ae 67 a3 a7 7c 2a fc 2f 8f 91 00 b1 30 2e e3 79 89 b2 6a 63 aa 09 35 f0 21 64 1b 11 2d 63 ad 66 6a be ca f2 d0 a8 5e d3 64 98 d8 1b 33 b9 87 81 6c bf 17 aa 4a 46 80 63 1f 38 38 32 7b 6f bb 24 5a 54 29 6c 0a 96 6c dc ab de a2 8e 92 03 f3 38 6b 5e 49 0b 0a e5 35 05 bb fb e0 69 7a 76 1f ab 8f 73 08 41 dd c5 a3 2a 9f d9 5e 38 5e a6 48 c7 40 33 85 5a Data Ascii: >g3lN{~d6]20#`H8j)SE2[D5d)/'@`P2GOAUfDa+l{gZ~)crv(g\|/0.yjc5!d-cfj^d3lJFc882{o$ZT)ll8k^I5izvsA^8^H@3Z

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:04 UTC	709	OUT	GET /isteam/ip/2f27a43e-01e9-4831-9035-55c692fc002b/gemini%20banner.png/:/cr=t:0%25,l:0%25,w:100%25,h:100%25/rs=w:1240,cg:true HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:04 UTC	646	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 25052 x-version: 0.4.8+sha-7c787a5 x-track-origin-referer: https://geminiloguiin.godaddysites.com/ Access-Control-Request-Method: GET Access-Control-Max-Age: 864000 ETag: 2579808372 x-width: 1240 x-height: 648 x-isteam-meta: {"orientation":1} Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:04 GMT Date: Sat, 22 Feb 2025 00:40:04 GMT Connection: close Edge-Cache-Tag: /isteam/ip/2f27a43e-01e9-4831-9035-55c692fc002b/gemini%20banner.png/:/cr=t:0%25,l:0%25,w:100%25,h:100%25/rs=w:1240,cg:true Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:04 UTC	1588	IN	Data Raw: 52 49 46 46 d4 61 00 00 57 45 42 50 56 50 38 58 0a 00 00 00 08 00 00 00 d7 04 00 87 02 00 56 50 38 20 f4 60 00 00 90 1b 02 9d 01 2a d8 04 88 02 3e 6d 36 97 49 24 22 a2 a4 21 f1 c9 90 80 0d 89 69 6e f7 ec 59 51 83 0e 00 39 e2 d9 b7 a1 8b 24 e5 71 89 63 2b f5 23 94 7d 13 3e 6c 9d c4 fc 72 fc 9c f7 bd e2 4f e0 ff c7 7e da 7f 77 f5 0f f2 7f aa 7f 0b fd d3 f6 db fb c7 ec f7 dc 8f e6 79 db ec f3 52 9f 94 fd d7 fc ef f8 2f dd 6f f1 df 3d ff 9e ff a5 fe 57 c8 5f 8e df e3 ff 94 fc a1 f9 08 fc 9f f9 ef f9 4f ee df b9 bf e1 b8 a2 f8 2f f8 ff f8 7d 42 fd ad fa df fc 2f f0 bf bc df e6 fe 04 7e eb ff 37 fa 6f 5a fe cb ff e0 f7 01 fe 79 fd bb fe 4f f8 2f 74 3f f2 78 bc fb 27 b0 37 f5 3f f4 bf fc bd 9b 7f cc ff e5 fe db fd c7 ee 77 be cf aa ff f6 ff ae f8 13 fe 89 fd f7 Data Ascii: RIFFaWEBPVP8XVP8 `*>m6I$"!inYQ9$qc+#}>lrO~wyR/o=W_O/}B/~7oZyO/t?x'7?w
2025-02-22 00:40:04 UTC	16384	IN	Data Raw: 1b 33 50 47 06 58 1d f1 a8 ab 97 2e d6 1f f4 56 d6 93 ed 57 58 33 e0 c9 79 c1 92 f3 81 98 88 36 c4 58 95 98 f5 38 ed 6c 7b 4d 91 e9 8f 60 55 c6 4f e5 75 d4 17 ca 85 93 5c 57 35 84 e2 56 5a ec 1a 53 36 fc a7 7d 89 f7 cc 89 66 fc ae 4c 88 0d a8 0a c1 25 e7 06 4b ce 0c 97 31 86 7c 19 2f 38 32 5e 70 64 b9 07 24 0f 61 99 ae b0 61 cf 2e 91 00 36 92 23 37 72 ad 2c 37 a1 e0 e3 de f7 6c e3 13 65 f7 c0 8e 84 a7 4b de 07 ad c3 82 76 09 54 4a c8 0c af c7 c2 d0 92 b6 f1 7c cf a1 a7 bb 55 ad 05 3a 2b 0d 26 de 4c f3 76 f5 35 f6 79 9b 76 1c cd 92 5f 68 db 3a e9 97 9d b6 9c 37 d4 91 3a 79 47 5a ac 2c e9 0e ab c0 6f f7 f2 e4 38 cc 37 1f d7 da 67 06 4b ce 0c 97 9c 18 3b 82 30 28 5d a3 61 e6 7c 19 2f 37 0b 07 9c 6e eb a8 c0 7f fe ec 30 7c d9 81 96 ea 0e 9d 89 1b 16 7c fd cd Data Ascii: 3PGX.VWX3y6X8l{M`UOu\W5VZS6}fL%K1\|/82^pd$aa.6#7r,7leKvTJ\|U:+&Lv5yv_h:7:yGZ,o87gK;0(]a\|/7n0\|\|
2025-02-22 00:40:04 UTC	7080	IN	Data Raw: 8e 44 5c 46 18 82 57 21 e7 2c 71 1a 2c 0f 34 5a 87 db ff c8 75 09 03 ad 82 c4 ba 7a c5 7f 49 97 a7 e6 60 d0 35 e6 92 9d 47 77 3e b3 3c 50 e8 4c 4e df 48 20 9b a9 c6 b6 09 2a b2 87 51 0b 75 32 69 86 73 d2 53 64 bf bf f6 74 c7 54 ce 61 74 be 74 49 bf 59 d8 da 09 db 16 fd 52 7f 05 26 80 d3 a6 3d c9 b3 8c a9 9a 34 bd f0 e8 07 94 c5 8c 06 07 8f 89 16 c6 d0 3b a1 09 69 98 b9 af 28 1f 4d fe d8 19 0d b0 ab a8 73 c2 a5 8b fe d8 97 b0 89 bf 38 71 04 53 fe 0c 06 4d c7 c1 7e 7f 87 69 94 e2 a3 ed 55 8c 79 6c 01 21 ea 88 a1 26 e5 6f 03 3b f4 aa 0d 60 bf 57 3c c9 70 72 41 ca 42 16 31 a2 94 b8 69 30 60 10 b7 4c 7a 9e 3d 8f 9e 9b ef 09 7c f7 e8 d4 ed 35 c2 f0 56 44 29 12 b7 c8 14 36 67 f8 11 d4 d3 23 1a 84 ad 15 2f 77 e8 57 10 3e 0d 40 e2 cd 7f 1e 08 d7 36 d6 b3 40 14 a5 Data Ascii: D\FW!,q,4ZuzI`5Gw><PLNH *Qu2isSdtTattIYR&=4;i(Ms8qSM~iUyl!&o;`W<prAB1i0`Lz=\|5VD)6g#/wW>@6@

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:04 UTC	651	OUT	GET /blobby/go/2f27a43e-01e9-4831-9035-55c692fc002b/gpub/311bf7ba6eb94be3/script.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:04 UTC	708	IN	HTTP/1.1 200 OK Content-Type: application/javascript x-version: 0.7.3+sha-a7223ca ETag: "6df33b5473bd03d07dc91131940f7e8c" Last-Modified: Tue, 15 Nov 2022 07:23:29 GMT x-amzn-trace-id: Root=1-63733e70-172f076e6bc5b9620063e477 x-forwarded-port: 443 X-Forwarded-For: 64.202.160.108 x-forwarded-proto: https Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:04 GMT Date: Sat, 22 Feb 2025 00:40:04 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:04 UTC	15676	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6e 61 76 69 67 61 74 6f 72 26 26 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6e 6e 65 63 74 69 6f 6e 26 26 28 77 69 6e 64 6f 77 2e 6e 65 74 77 6f 72 6b 49 6e 66 6f 3d 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6e 6e 65 63 74 69 6f 6e 2c 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6e 6e 65 63 74 69 6f 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 26 26 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6e 6e 65 63 74 69 6f 6e 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 68 61 6e 67 65 22 2c 28 7b 74 61 72 67 65 74 3a 6e 7d 29 3d 3e 77 69 6e 64 6f 77 2e 6e 65 74 77 6f 72 6b 49 6e 66 6f 3d 6e 29 29 3b 0a 63 6f 6e 73 74 20 69 6d 61 67 65 4f 62 73 65 72 76 65 72 3d 6e 65 77 20 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 28 65 Data Ascii: 00006000navigator&&navigator.connection&&(window.networkInfo=navigator.connection,navigator.connection.addEventListener&&navigator.connection.addEventListener("change",({target:n})=>window.networkInfo=n));const imageObserver=new IntersectionObserver((e
2025-02-22 00:40:04 UTC	8912	IN	Data Raw: 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 6f 6e 74 61 63 74 31 30 2d 62 38 32 63 64 35 66 36 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 32 35 2c 32 39 5d 7d 5d 5d 2c 5b 5c 22 63 6f 6e 74 61 63 74 32 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 6f 6e 74 61 63 74 32 2d 31 62 64 63 36 64 64 32 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 32 35 2c 32 36 2c 32 39 5d 7d 5d 5d 2c 5b 5c 22 63 6f 6e 74 61 63 74 33 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 6f 6e 74 61 63 74 33 2d 36 34 63 30 30 64 34 63 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 32 34 2c 32 36 5d 7d 5d 5d 2c 5b 5c 22 63 6f 6e 74 61 63 74 34 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 6f 6e 74 61 63 74 34 2d Data Ascii: [{\"v\":[0],\"f\":\"contact10-b82cd5f6.js\",\"s\":[25,29]}]],[\"contact2\",[{\"v\":[0],\"f\":\"contact2-1bdc6dd2.js\",\"s\":[25,26,29]}]],[\"contact3\",[{\"v\":[0],\"f\":\"contact3-64c00d4c.js\",\"s\":[24,26]}]],[\"contact4\",[{\"v\":[0],\"f\":\"contact4-
2025-02-22 00:40:04 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 5c 22 66 5c 22 3a 5c 22 69 6e 74 72 6f 64 75 63 74 69 6f 6e 35 2d 39 64 34 61 32 33 30 66 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 36 2c 37 5d 7d 5d 5d 2c 5b 5c 22 63 2f 64 61 74 61 41 69 64 73 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 64 61 74 61 41 69 64 73 2d 63 31 64 32 66 38 32 32 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 37 5d 7d 5d 5d 2c 5b 5c 22 63 2f 64 65 66 61 75 6c 74 50 72 6f 70 73 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 64 65 66 61 75 6c 74 50 72 6f 70 73 2d 33 62 36 65 35 39 63 38 2e 6a 73 5c 22 7d 5d 5d 2c 5b 5c 22 63 2f 69 6e 64 65 78 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 69 6e 64 65 78 2d 32 64 36 38 62 34 37 Data Ascii: 00006000\"f\":\"introduction5-9d4a230f.js\",\"s\":[6,7]}]],[\"c/dataAids\",[{\"v\":[0],\"f\":\"c/dataAids-c1d2f822.js\",\"s\":[7]}]],[\"c/defaultProps\",[{\"v\":[0],\"f\":\"c/defaultProps-3b6e59c8.js\"}]],[\"c/index\",[{\"v\":[0],\"f\":\"c/index-2d68b47
2025-02-22 00:40:04 UTC	8204	IN	Data Raw: 22 3a 5c 22 63 2f 5f 63 6f 6d 6d 6f 6e 6a 73 48 65 6c 70 65 72 73 2d 63 30 63 35 64 32 37 61 2e 6a 73 5c 22 7d 5d 5d 2c 5b 5c 22 63 2f 62 73 2d 5f 62 61 73 65 53 6c 69 63 65 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 62 73 2d 5f 62 61 73 65 53 6c 69 63 65 2d 61 62 63 33 38 34 38 64 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 32 33 5d 7d 5d 5d 2c 5b 5c 22 63 2f 62 73 2d 5f 63 6f 6d 6d 6f 6e 6a 73 48 65 6c 70 65 72 73 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 62 73 2d 5f 63 6f 6d 6d 6f 6e 6a 73 48 65 6c 70 65 72 73 2d 63 30 63 35 64 32 37 61 2e 6a 73 5c 22 7d 5d 5d 2c 5b 5c 22 63 2f 62 73 2d 63 6c 69 65 6e 74 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 62 73 2d 63 6c Data Ascii: ":\"c/_commonjsHelpers-c0c5d27a.js\"}]],[\"c/bs-_baseSlice\",[{\"v\":[0],\"f\":\"c/bs-_baseSlice-abc3848d.js\",\"s\":[23]}]],[\"c/bs-_commonjsHelpers\",[{\"v\":[0],\"f\":\"c/bs-_commonjsHelpers-c0c5d27a.js\"}]],[\"c/bs-client\",[{\"v\":[0],\"f\":\"c/bs-cl
2025-02-22 00:40:04 UTC	6146	IN	Data Raw: 30 30 30 30 31 37 46 36 0d 0a 64 63 35 35 63 35 34 2e 6a 73 5c 22 7d 5d 5d 2c 5b 5c 22 63 2f 62 73 2d 46 65 61 74 75 72 65 64 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 62 73 2d 46 65 61 74 75 72 65 64 2d 63 30 38 30 39 64 63 65 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 30 2c 31 31 2c 31 32 2c 31 39 2c 37 5d 7d 5d 5d 2c 5b 5c 22 63 2f 62 73 2d 46 65 74 63 68 69 6e 67 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 62 73 2d 46 65 74 63 68 69 6e 67 2d 61 66 66 62 62 37 32 34 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 30 5d 7d 5d 5d 2c 5b 5c 22 63 2f 62 73 2d 67 65 74 53 74 79 6c 65 73 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 63 2f 62 73 2d 67 65 74 53 74 79 6c 65 73 2d 36 33 65 Data Ascii: 000017F6dc55c54.js\"}]],[\"c/bs-Featured\",[{\"v\":[0],\"f\":\"c/bs-Featured-c0809dce.js\",\"s\":[0,11,12,19,7]}]],[\"c/bs-Fetching\",[{\"v\":[0],\"f\":\"c/bs-Fetching-affbb724.js\",\"s\":[0]}]],[\"c/bs-getStyles\",[{\"v\":[0],\"f\":\"c/bs-getStyles-63e
2025-02-22 00:40:05 UTC	5020	IN	Data Raw: 30 30 30 30 31 33 39 30 0d 0a 36 5d 7d 5d 5d 2c 5b 5c 22 62 73 2d 73 75 62 73 63 72 69 62 65 33 2d 73 75 62 73 63 72 69 62 65 2d 66 6f 72 6d 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 62 73 2d 73 75 62 73 63 72 69 62 65 33 2d 73 75 62 73 63 72 69 62 65 2d 66 6f 72 6d 2d 37 63 36 38 34 64 35 61 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 36 5d 7d 5d 5d 2c 5b 5c 22 73 75 62 73 63 72 69 62 65 31 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 73 75 62 73 63 72 69 62 65 31 2d 39 33 65 32 30 62 31 33 2e 6a 73 5c 22 2c 5c 22 73 5c 22 3a 5b 37 5d 7d 5d 5d 2c 5b 5c 22 73 75 62 73 63 72 69 62 65 32 5c 22 2c 5b 7b 5c 22 76 5c 22 3a 5b 30 5d 2c 5c 22 66 5c 22 3a 5c 22 73 75 62 73 63 72 69 62 65 32 2d 37 34 34 35 33 39 66 31 Data Ascii: 000013906]}]],[\"bs-subscribe3-subscribe-form\",[{\"v\":[0],\"f\":\"bs-subscribe3-subscribe-form-7c684d5a.js\",\"s\":[6]}]],[\"subscribe1\",[{\"v\":[0],\"f\":\"subscribe1-93e20b13.js\",\"s\":[7]}]],[\"subscribe2\",[{\"v\":[0],\"f\":\"subscribe2-744539f1
2025-02-22 00:40:05 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:05 UTC	604	OUT	GET /tcc/tcc_l.combined.1.0.6.min.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:05 UTC	312	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js Cache-Control: max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:05 GMT Date: Sat, 22 Feb 2025 00:40:05 GMT Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:05 UTC	656	OUT	GET /blobby/go/static/radpack/@widget/LAYOUT/bs-layout28-Theme-publish-Theme-24cd15e9.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:06 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/javascript x-version: 0.7.3+sha-a7223ca ETag: "4f4ef394e123ee966048b4b338874363" Last-Modified: Wed, 26 Oct 2022 17:30:52 GMT x-amzn-trace-id: Root=1-63596ecb-37f3ad7205dc40e123604317 x-forwarded-port: 443 X-Forwarded-For: 64.202.160.104 x-forwarded-proto: https Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:05 GMT Date: Sat, 22 Feb 2025 00:40:05 GMT Content-Length: 17364 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:06 UTC	15713	IN	Data Raw: 64 65 66 69 6e 65 28 22 40 77 69 64 67 65 74 2f 4c 41 59 4f 55 54 2f 62 73 2d 6c 61 79 6f 75 74 32 38 2d 54 68 65 6d 65 2d 70 75 62 6c 69 73 68 2d 54 68 65 6d 65 2d 32 34 63 64 31 35 65 39 2e 6a 73 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 7e 2f 63 2f 62 73 2d 5f 72 6f 6c 6c 75 70 50 6c 75 67 69 6e 42 61 62 65 6c 48 65 6c 70 65 72 73 22 2c 22 7e 2f 63 2f 62 73 2d 69 6e 64 65 78 33 22 2c 22 7e 2f 63 2f 62 73 2d 69 6e 64 65 78 22 2c 22 7e 2f 63 2f 62 73 2d 69 6e 64 65 78 32 22 2c 22 7e 2f 63 2f 62 73 2d 6d 6f 64 65 72 6e 54 68 69 6e 52 6f 75 6e 64 22 2c 22 7e 2f 63 2f 62 73 2d 64 65 66 61 75 6c 74 53 6f 63 69 61 6c 49 63 6f 6e 50 61 63 6b 22 2c 22 7e 2f 63 2f 62 73 2d 6c 6f 61 64 65 72 73 22 2c 22 7e 2f 63 2f 62 73 2d 6f 76 65 72 6c 61 79 54 79 70 65 73 22 Data Ascii: define("@widget/LAYOUT/bs-layout28-Theme-publish-Theme-24cd15e9.js",["exports","~/c/bs-_rollupPluginBabelHelpers","~/c/bs-index3","~/c/bs-index","~/c/bs-index2","~/c/bs-modernThinRound","~/c/bs-defaultSocialIconPack","~/c/bs-loaders","~/c/bs-overlayTypes"
2025-02-22 00:40:06 UTC	1651	IN	Data Raw: 78 74 28 65 29 7b 63 6f 6e 73 74 7b 77 69 64 67 65 74 50 72 65 73 65 74 3a 74 7d 3d 74 68 69 73 2e 62 61 73 65 3b 72 65 74 75 72 6e 20 73 75 70 65 72 2e 46 65 61 74 75 72 65 64 54 65 78 74 28 74 68 69 73 2e 6d 65 72 67 65 28 7b 73 74 79 6c 65 3a 7b 2e 2e 2e 28 22 63 6f 6e 74 65 6e 74 34 22 3d 3d 3d 74 7c 7c 22 69 6e 74 72 6f 64 75 63 74 69 6f 6e 34 22 3d 3d 3d 74 29 26 26 7b 6d 61 72 67 69 6e 42 6f 74 74 6f 6d 3a 22 33 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 22 7d 7d 7d 2c 65 29 29 7d 50 72 6f 6d 6f 42 61 6e 6e 65 72 28 65 29 7b 72 65 74 75 72 6e 20 73 75 70 65 72 2e 50 72 6f 6d 6f 42 61 6e 6e 65 72 28 74 68 69 73 2e 6d 65 72 67 65 28 7b 63 61 74 65 67 6f 72 79 3a 22 70 72 69 6d 61 72 79 22 2c 73 74 79 6c 65 3a 7b 70 6f 73 69 74 69 6f 6e 3a 22 72 65 6c Data Ascii: xt(e){const{widgetPreset:t}=this.base;return super.FeaturedText(this.merge({style:{...("content4"===t\|\|"introduction4"===t)&&{marginBottom:"30px !important"}}},e))}PromoBanner(e){return super.PromoBanner(this.merge({category:"primary",style:{position:"rel

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:05 UTC	561	OUT	GET /traffic-assets/js/tccl-tti.min.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:06 UTC	306	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://img1.wsimg.com/signals/js/clients/tti/tti.min.js Cache-Control: max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:05 GMT Date: Sat, 22 Feb 2025 00:40:05 GMT Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:06 UTC	612	OUT	GET /signals/js/clients/scc-c2/scc-c2.min.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:06 UTC	622	IN	HTTP/1.1 200 OK x-amz-id-2: o7b+yi7y+tOLA7xUjXevghXwILi+lYAdQkeCbdc/fXSDY5yTOMod6FXTMgygYXU2+MatbipnFL4= x-amz-request-id: HH2VP67X4TDKV43Z Last-Modified: Sun, 22 Dec 2024 23:44:31 GMT ETag: "6837678401f602120e41c9eaa7a7e915" x-amz-server-side-encryption: AES256 x-amz-meta-version: 1.0.1 x-amz-version-id: SVyl5KN5ySTpQdvaNSN8cRWDnhBms6BO Content-Type: text/javascript Cache-Control: max-age=1800 Expires: Sat, 22 Feb 2025 01:10:06 GMT Date: Sat, 22 Feb 2025 00:40:06 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:06 UTC	15762	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 22 73 63 63 2d 63 32 22 2c 5b 5d 2c 65 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 5b 22 73 63 63 2d 63 32 22 5d 3d 65 28 29 3a 74 5b 22 73 63 63 2d 63 32 22 5d 3d 65 28 29 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 64 Data Ascii: 00006000!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define("scc-c2",[],e):"object"==typeof exports?exports["scc-c2"]=e():t["scc-c2"]=e()}(self,(()=>(()=>{"use strict";var t={d
2025-02-22 00:40:06 UTC	8826	IN	Data Raw: 74 65 6d 70 74 20 74 6f 20 73 70 72 65 61 64 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 2e 5c 6e 49 6e 20 6f 72 64 65 72 20 74 6f 20 62 65 20 69 74 65 72 61 62 6c 65 2c 20 6e 6f 6e 2d 61 72 72 61 79 20 6f 62 6a 65 63 74 73 20 6d 75 73 74 20 68 61 76 65 20 61 20 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 28 29 20 6d 65 74 68 6f 64 2e 22 29 7d 28 29 7d 28 6e 2e 65 76 65 6e 74 73 2e 73 6c 69 63 65 28 30 2c 74 68 69 73 2e 5f 6d 61 78 45 76 65 6e 74 73 29 29 29 2c 6e 2e 65 76 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 74 68 69 73 2e 5f 6d 61 78 45 76 65 6e 74 73 26 26 74 68 69 73 2e 70 75 73 68 45 76 65 6e 74 28 54 28 6e 2c 7b 65 76 65 6e 74 73 3a 6e 2e 65 76 65 6e 74 73 2e 73 6c 69 63 65 28 74 68 69 73 2e 5f 6d 61 78 45 76 65 6e 74 73 Data Ascii: tempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}(n.events.slice(0,this._maxEvents))),n.events.length>this._maxEvents&&this.pushEvent(T(n,{events:n.events.slice(this._maxEvents
2025-02-22 00:40:06 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6e 3f 41 72 72 61 79 2e 66 72 6f 6d 28 74 29 3a 22 41 72 67 75 6d 65 6e 74 73 22 3d 3d 3d 6e 7c 7c 2f 5e 28 3f 3a 55 69 7c 49 29 6e 74 28 3f 3a 38 7c 31 36 7c 33 32 29 28 3f 3a 43 6c 61 6d 70 65 64 29 3f 41 72 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 3f 75 65 28 74 2c 65 29 3a 76 6f 69 64 20 30 7d 7d 28 74 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 61 74 74 65 6d 70 74 20 74 6f 20 73 70 72 65 61 64 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 2e 5c 6e 49 6e 20 6f 72 64 65 72 20 74 6f 20 62 65 20 69 74 65 72 61 62 6c 65 2c 20 6e 6f 6e 2d 61 72 72 61 79 20 6f 62 6a 65 63 74 73 20 6d 75 73 74 20 68 61 76 65 20 61 20 5b 53 79 Data Ascii: 00006000n?Array.from(t):"Arguments"===n\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n)?ue(t,e):void 0}}(t)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Sy
2025-02-22 00:40:06 UTC	8204	IN	Data Raw: 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 76 61 72 20 6e 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 21 28 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 28 74 68 69 73 2c 65 29 2c 28 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 72 65 74 75 72 6e 20 65 3d 70 6e 28 65 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 65 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 63 6e 28 65 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 29 29 72 65 74 75 72 6e 20 65 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 65 29 74 68 72 6f 77 Data Ascii: n(t){function e(t){var n;return function(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}(this,e),(n=function(t,e,n){return e=pn(e),function(t,e){if(e&&("object"==cn(e)\|\|"function"==typeof e))return e;if(void 0!==e)throw
2025-02-22 00:40:06 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6e 61 6d 65 22 29 7d 2c 22 63 6c 69 65 6e 74 2e 73 64 6b 2e 76 65 72 73 69 6f 6e 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4b 74 28 22 63 6c 69 65 6e 74 22 2c 22 76 65 72 73 69 6f 6e 22 29 7d 2c 22 63 6c 69 65 6e 74 2e 64 65 76 69 63 65 2e 76 69 65 77 70 6f 72 74 57 69 64 74 68 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 77 69 6e 2c 6e 3d 74 2e 64 6f 63 3b 72 65 74 75 72 6e 20 4d 28 65 2e 69 6e 6e 65 72 57 69 64 74 68 3f 65 2e 69 6e 6e 65 72 57 69 64 74 68 3a 6e 2e 62 6f 64 79 2e 6f 66 66 73 65 74 57 69 64 74 68 29 7d 2c 22 63 6c 69 65 6e 74 2e 64 65 76 69 63 65 2e 76 69 65 77 70 6f 72 74 48 65 69 67 68 74 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 77 69 6e 2c 6e Data Ascii: 00004000name")},"client.sdk.version":function(){return Kt("client","version")},"client.device.viewportWidth":function(t){var e=t.win,n=t.doc;return M(e.innerWidth?e.innerWidth:n.body.offsetWidth)},"client.device.viewportHeight":function(t){var e=t.win,n
2025-02-22 00:40:06 UTC	12	IN	Data Raw: 6e 63 74 69 6f 6e 28 74 2c 65 0d 0a Data Ascii: nction(t,e
2025-02-22 00:40:06 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 74 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 74 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 77 72 69 74 Data Ascii: 00004000){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),Object.defineProperty(t,"prototype",{writ
2025-02-22 00:40:06 UTC	12	IN	Data Raw: 74 68 72 6f 77 20 6e 65 77 20 0d 0a Data Ascii: throw new
2025-02-22 00:40:06 UTC	1111	IN	Data Raw: 30 30 30 30 30 34 34 42 0d 0a 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 74 7d 28 74 29 7d 28 74 2c 57 6f 28 29 3f 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 65 2c 6e 7c 7c 5b 5d 2c 24 6f 28 74 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 3a 65 2e 61 70 70 6c 79 28 74 2c 6e 29 29 7d 28 74 68 69 73 2c 65 2c 61 72 67 75 6d 65 6e 74 73 29 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 Data Ascii: 0000044BReferenceError("this hasn't been initialised - super() hasn't been called");return t}(t)}(t,Wo()?Reflect.construct(e,n\|\|[],$o(t).constructor):e.apply(t,n))}(this,e,arguments)}return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeE
2025-02-22 00:40:06 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2e 6d 65 72 67 65 28 5f 6e 28 29 29 7d 7d 5d 29 26 26 7a 6f 28 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 72 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 6e 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2c 6e 3b 76 61 72 20 6e 2c 72 7d 28 62 72 29 2c 59 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 5b 28 6e 65 77 20 7a 65 29 2e 6d 61 70 28 22 65 6c 65 6d 65 6e 74 22 2c 5b 6e 65 77 20 47 65 28 22 61 72 65 61 22 29 2e 72 65 71 75 69 72 65 64 28 29 2e 70 61 74 74 65 72 6e 28 5f 65 29 2c 6e 65 77 20 47 65 28 22 70 72 6f 64 75 63 74 22 29 2e 72 65 71 75 69 72 65 64 28 29 2e 70 61 74 74 65 72 6e 28 5f 65 29 2c 6e 65 77 20 47 65 28 22 73 65 63 74 69 6f 6e 22 29 2e Data Ascii: 00004000.merge(_n())}}])&&zo(n.prototype,r),Object.defineProperty(n,"prototype",{writable:!1}),n;var n,r}(br),Yo=function(t){return[(new ze).map("element",[new Ge("area").required().pattern(_e),new Ge("product").required().pattern(_e),new Ge("section").

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:06 UTC	636	OUT	GET /blobby/go/static/radpack/@widget/LAYOUT/c/bs-index2-87bd33e6.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:07 UTC	670	IN	HTTP/1.1 200 OK Content-Type: application/javascript x-version: 0.7.3+sha-a7223ca ETag: "5cc6b93d41889c0a55c6c4fcd2d89713" Last-Modified: Tue, 18 Oct 2022 15:47:53 GMT x-amzn-trace-id: Root=1-634ecaa8-5441fae57a8929061baf3c6b x-forwarded-port: 443 X-Forwarded-For: 64.202.160.104 x-forwarded-proto: https Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:06 GMT Date: Sat, 22 Feb 2025 00:40:06 GMT Content-Length: 1400 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:07 UTC	1400	IN	Data Raw: 64 65 66 69 6e 65 28 22 40 77 69 64 67 65 74 2f 4c 41 59 4f 55 54 2f 63 2f 62 73 2d 69 6e 64 65 78 32 2d 38 37 62 64 33 33 65 36 2e 6a 73 22 2c 5b 22 65 78 70 6f 72 74 73 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 22 6d 65 64 69 75 6d 22 3b 72 65 74 75 72 6e 7b 22 3e 20 3a 6e 74 68 2d 63 68 69 6c 64 28 6e 29 22 3a 7b 6d 61 72 67 69 6e 42 6f 74 74 6f 6d 3a 74 7d 2c 22 20 3e 20 3a 6c 61 73 74 2d 63 68 69 6c 64 22 3a 7b 6d 61 72 67 69 6e 42 6f 74 74 6f 6d 3a 22 30 20 21 69 6d 70 6f 72 74 61 Data Ascii: define("@widget/LAYOUT/c/bs-index2-87bd33e6.js",["exports"],(function(t){"use strict";t.a=function(){let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"medium";return{"> :nth-child(n)":{marginBottom:t}," > :last-child":{marginBottom:"0 !importa

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://geminiloguiin.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\Filtering Rules

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\LICENSE.txt

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_563652812\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping2076_979903105\sets.json

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Windows Analysis Report
http://geminiloguiin.godaddysites.com/

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:06 UTC	561	OUT	GET /signals/js/clients/tti/tti.min.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:07 UTC	597	IN	HTTP/1.1 200 OK x-amz-id-2: RZMQvhqErG3MQICO6SkG1Bn0dqoyuRcZH3NxHmlvkIyvCqD0eWvemluk54yHb0l+QlY6q6O9IIWM+QQVVbo4VQ== x-amz-request-id: HH2M81AEM0MT659V Last-Modified: Wed, 18 Oct 2023 13:46:08 GMT ETag: "1c56940a864f144fae2eb40ee952cb94" x-amz-server-side-encryption: AES256 x-amz-meta-version: 0.2.1 x-amz-version-id: 7jzjltvngWPxR10aGBgezMSyuI8q8r0u Content-Type: text/javascript Cache-Control: max-age=1800 Expires: Sat, 22 Feb 2025 01:10:06 GMT Date: Sat, 22 Feb 2025 00:40:06 GMT Content-Length: 21592 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:07 UTC	15787	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 22 74 74 69 22 2c 5b 5d 2c 65 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 5b 22 74 74 69 22 5d 3d 65 28 29 3a 74 5b 22 74 74 69 22 5d 3d 65 28 29 7d 28 77 69 6e 64 6f 77 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 3d 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e Data Ascii: !function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define("tti",[],e):"object"==typeof exports?exports["tti"]=e():t["tti"]=e()}(window,function(){return n=[function(t,e){var n=function
2025-02-22 00:40:07 UTC	5805	IN	Data Raw: 64 65 22 2c 72 2c 21 30 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 7b 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 70 61 67 65 73 68 6f 77 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 70 65 72 73 69 73 74 65 64 26 26 65 28 74 29 7d 2c 21 30 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 6e 2c 72 29 7b 76 61 72 20 69 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 30 3c 3d 6e 2e 76 61 6c 75 65 26 26 28 74 7c 7c 72 29 26 26 28 6e 2e 64 65 6c 74 61 3d 6e 2e 76 61 6c 75 65 2d 28 69 7c 7c 30 29 2c 21 6e 2e 64 65 6c 74 61 26 26 76 6f 69 64 20 30 21 3d 3d 69 7c 7c 28 69 3d 6e 2e 76 61 6c 75 65 2c 65 28 6e 29 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 72 65 74 75 72 6e 22 68 69 64 64 65 6e 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 76 Data Ascii: de",r,!0)}function d(e){addEventListener("pageshow",function(t){t.persisted&&e(t)},!0)}function p(e,n,r){var i;return function(t){0<=n.value&&(t\|\|r)&&(n.delta=n.value-(i\|\|0),!n.delta&&void 0!==i\|\|(i=n.value,e(n)))}}function r(){return"hidden"===document.v

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:07 UTC	657	OUT	GET /blobby/go/static/radpack/@wsb/guac-widget-shared/lib/components/Carousel-3d82957b.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://geminiloguiin.godaddysites.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:08 UTC	671	IN	HTTP/1.1 200 OK Content-Type: application/javascript x-version: 0.7.3+sha-a7223ca ETag: "753cb19ee1a756e46faa0f118b1b4e01" Last-Modified: Tue, 13 Sep 2022 20:51:07 GMT x-amzn-trace-id: Root=1-6320ed3a-63510b321c43bb775186e613 x-forwarded-port: 443 X-Forwarded-For: 64.202.160.106 x-forwarded-proto: https Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:07 GMT Date: Sat, 22 Feb 2025 00:40:07 GMT Content-Length: 24399 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:08 UTC	15713	IN	Data Raw: 64 65 66 69 6e 65 28 22 40 77 73 62 2f 67 75 61 63 2d 77 69 64 67 65 74 2d 73 68 61 72 65 64 2f 6c 69 62 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 43 61 72 6f 75 73 65 6c 2d 33 64 38 32 39 35 37 62 2e 6a 73 22 2c 5b 22 65 78 70 6f 72 74 73 22 2c 22 7e 2f 63 2f 5f 72 6f 6c 6c 75 70 50 6c 75 67 69 6e 42 61 62 65 6c 48 65 6c 70 65 72 73 22 2c 22 7e 2f 63 2f 5f 63 6f 6d 6d 6f 6e 6a 73 48 65 6c 70 65 72 73 22 2c 22 7e 2f 63 2f 69 6e 74 65 72 6f 70 52 65 71 75 69 72 65 44 65 66 61 75 6c 74 22 2c 22 7e 2f 63 2f 5f 72 65 61 63 74 5f 63 6f 6d 6d 6f 6e 6a 73 2d 65 78 74 65 72 6e 61 6c 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 69 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 73 3d 6e 2e 63 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e Data Ascii: define("@wsb/guac-widget-shared/lib/components/Carousel-3d82957b.js",["exports","~/c/_rollupPluginBabelHelpers","~/c/_commonjsHelpers","~/c/interopRequireDefault","~/c/_react_commonjs-external"],(function(e,t,n,i,r){"use strict";var s=n.c((function(e){fun
2025-02-22 00:40:08 UTC	8686	IN	Data Raw: 69 73 2e 73 74 61 74 65 2e 6c 6f 61 64 65 64 49 6d 61 67 65 73 2c 5b 65 5d 3a 7b 77 69 64 74 68 3a 74 2e 77 69 64 74 68 7c 7c 22 61 75 74 6f 22 2c 68 65 69 67 68 74 3a 74 2e 68 65 69 67 68 74 7c 7c 22 61 75 74 6f 22 7d 7d 7d 2c 28 28 29 3d 3e 7b 65 3d 3d 3d 6c 26 26 74 68 69 73 2e 68 61 6e 64 6c 65 49 6e 69 74 69 61 6c 4c 6f 61 64 28 29 7d 29 29 7d 2c 74 2e 73 72 63 3d 65 7d 29 29 3a 74 68 69 73 2e 63 61 6c 63 4c 65 66 74 4f 66 66 73 65 74 28 29 7d 67 65 74 43 6f 6e 74 72 6f 6c 73 28 29 7b 63 6f 6e 73 74 7b 61 72 72 6f 77 73 3a 65 2c 64 6f 74 73 3a 74 2c 63 6f 6e 74 72 6f 6c 73 3a 6e 7d 3d 74 68 69 73 2e 70 72 6f 70 73 3b 6c 65 74 20 69 3d 6e 2e 73 6c 69 63 65 28 30 29 3b 72 65 74 75 72 6e 20 74 26 26 69 2e 70 75 73 68 28 7b 63 6f 6d 70 6f 6e 65 6e 74 3a Data Ascii: is.state.loadedImages,[e]:{width:t.width\|\|"auto",height:t.height\|\|"auto"}}},(()=>{e===l&&this.handleInitialLoad()}))},t.src=e})):this.calcLeftOffset()}getControls(){const{arrows:e,dots:t,controls:n}=this.props;let i=n.slice(0);return t&&i.push({component:

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:08 UTC	407	OUT	GET /blobby/go/static/radpack/@widget/LAYOUT/c/bs-overlayTypes-e1dbe765.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:09 UTC	669	IN	HTTP/1.1 200 OK Content-Type: application/javascript x-version: 0.7.3+sha-a7223ca ETag: "21ad22788e6caa18a4e9e57f7372b108" Last-Modified: Mon, 13 Dec 2021 22:59:02 GMT x-amzn-trace-id: Root=1-61b7d035-018188ae176241301ebce646 x-forwarded-port: 443 X-Forwarded-For: 64.202.160.105 x-forwarded-proto: https Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:08 GMT Date: Sat, 22 Feb 2025 00:40:08 GMT Content-Length: 437 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:09 UTC	437	IN	Data Raw: 64 65 66 69 6e 65 28 22 40 77 69 64 67 65 74 2f 4c 41 59 4f 55 54 2f 63 2f 62 73 2d 6f 76 65 72 6c 61 79 54 79 70 65 73 2d 65 31 64 62 65 37 36 35 2e 6a 73 22 2c 5b 22 65 78 70 6f 72 74 73 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 63 6f 6e 73 74 7b 68 65 61 64 65 72 54 72 65 61 74 6d 65 6e 74 73 3a 7b 46 49 4c 4c 3a 6e 2c 46 49 54 3a 74 2c 49 4e 53 45 54 3a 6f 2c 42 4c 55 52 3a 61 2c 4c 45 47 41 43 59 5f 42 4c 55 52 3a 63 7d 7d 3d 28 67 6c 6f 62 61 6c 2e 43 6f 72 65 7c 7c 67 75 61 63 5b 22 40 77 73 62 2f 67 75 61 63 2d 77 69 64 67 65 74 2d 63 6f 72 65 22 5d 29 2e 63 6f 6e 73 74 61 6e 74 73 3b 65 2e 41 3d 22 61 63 63 65 6e 74 22 2c 65 2e 42 3d 61 2c 65 2e 43 3d 22 63 61 74 65 67 6f 72 79 22 2c 65 2e 46 3d 6e 2c Data Ascii: define("@widget/LAYOUT/c/bs-overlayTypes-e1dbe765.js",["exports"],(function(e){"use strict";const{headerTreatments:{FILL:n,FIT:t,INSET:o,BLUR:a,LEGACY_BLUR:c}}=(global.Core\|\|guac["@wsb/guac-widget-core"]).constants;e.A="accent",e.B=a,e.C="category",e.F=n,

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:09 UTC	666	OUT	GET /sw.js HTTP/1.1 Host: geminiloguiin.godaddysites.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://geminiloguiin.godaddysites.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=04b92a6d-c0a3-4e03-938c-00bddc63181e; _tccl_visit=04b92a6d-c0a3-4e03-938c-00bddc63181e; _scc_session=pc=1&C_TOUCH=2025-02-22T00:40:05.634Z
2025-02-22 00:40:09 UTC	736	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Content-Type: application/javascript Vary: Accept-Encoding Server: DPS/2.0.0+sha-999b56c X-Version: 999b56c X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: da038d1cfd71e464ab76dc7f868c7c6a Date: Sat, 22 Feb 2025 00:40:09 GMT Connection: close Transfer-Encoding: chunked
2025-02-22 00:40:09 UTC	15648	IN	Data Raw: 38 30 62 36 0d 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 38 39 35 3a 28 29 3d 3e 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 61 63 68 65 61 62 6c 65 2d 72 65 73 70 6f 6e 73 65 3a 36 2e 34 2e 31 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 32 35 39 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 42 3a 28 29 3d 3e 61 7d 29 2c 73 28 39 31 33 29 3b 63 6c 61 73 73 20 61 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 28 65 2c 74 29 3d 3e 7b 74 68 69 73 2e 72 65 73 6f 6c 76 65 3d 65 2c 74 68 69 73 2e 72 65 6a 65 63 74 3d 74 7d 29 29 7d 7d 7d 2c 31 32 35 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 56 3a Data Ascii: 80b6(()=>{"use strict";var e={895:()=>{try{self["workbox:cacheable-response:6.4.1"]&&_()}catch(e){}},259:(e,t,s)=>{s.d(t,{B:()=>a}),s(913);class a{constructor(){this.promise=new Promise(((e,t)=>{this.resolve=e,this.reject=t}))}}},125:(e,t,s)=>{s.d(t,{V:
2025-02-22 00:40:09 UTC	16384	IN	Data Raw: 2c 72 29 2c 72 7d 76 61 72 20 52 3b 52 3d 64 2c 64 3d 7b 2e 2e 2e 52 2c 67 65 74 3a 28 65 2c 74 2c 73 29 3d 3e 5f 28 65 2c 74 29 7c 7c 52 2e 67 65 74 28 65 2c 74 2c 73 29 2c 68 61 73 3a 28 65 2c 74 29 3d 3e 21 21 5f 28 65 2c 74 29 7c 7c 52 2e 68 61 73 28 65 2c 74 29 7d 2c 73 28 35 35 30 29 3b 63 6f 6e 73 74 20 76 3d 22 63 61 63 68 65 2d 65 6e 74 72 69 65 73 22 2c 62 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 52 4c 28 65 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 72 65 74 75 72 6e 20 74 2e 68 61 73 68 3d 22 22 2c 74 2e 68 72 65 66 7d 3b 63 6c 61 73 73 20 78 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 73 2e 5f 64 62 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 61 63 68 65 4e 61 6d 65 3d 65 7d 5f 75 70 67 72 61 64 65 44 62 28 65 29 7b Data Ascii: ,r),r}var R;R=d,d={...R,get:(e,t,s)=>_(e,t)\|\|R.get(e,t,s),has:(e,t)=>!!_(e,t)\|\|R.has(e,t)},s(550);const v="cache-entries",b=e=>{const t=new URL(e,location.href);return t.hash="",t.href};class x{constructor(e){this._db=null,this._cacheName=e}_upgradeDb(e){
2025-02-22 00:40:09 UTC	931	IN	Data Raw: 2e 43 61 63 68 65 61 62 6c 65 52 65 73 70 6f 6e 73 65 50 6c 75 67 69 6e 28 7b 73 74 61 74 75 73 65 73 3a 5b 32 30 30 5d 7d 29 5d 7d 29 29 2c 28 30 2c 65 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 29 28 28 28 7b 72 65 71 75 65 73 74 3a 65 7d 29 3d 3e 22 73 74 79 6c 65 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 7c 7c 22 73 63 72 69 70 74 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 29 2c 6e 65 77 20 74 2e 53 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 28 7b 63 61 63 68 65 4e 61 6d 65 3a 22 73 74 61 74 69 63 2d 72 65 73 6f 75 72 63 65 73 22 2c 70 6c 75 67 69 6e 73 3a 5b 6e 65 77 20 61 2e 43 61 63 68 65 61 62 6c 65 52 65 73 70 6f 6e 73 65 50 6c 75 67 69 6e 28 7b 73 74 61 74 75 73 65 73 3a 5b 32 30 30 5d 7d 29 5d 7d 29 29 2c 28 30 2c Data Ascii: .CacheableResponsePlugin({statuses:[200]})]})),(0,e.registerRoute)((({request:e})=>"style"===e.destination\|\|"script"===e.destination),new t.StaleWhileRevalidate({cacheName:"static-resources",plugins:[new a.CacheableResponsePlugin({statuses:[200]})]})),(0,

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:09 UTC	564	OUT	GET /manifest.webmanifest HTTP/1.1 Host: geminiloguiin.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:09 UTC	739	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Content-Type: application/manifest+json Vary: Accept-Encoding Server: DPS/2.0.0+sha-999b56c X-Version: 999b56c X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: f1058535ae5ea7679201466f64ab314a Date: Sat, 22 Feb 2025 00:40:09 GMT Connection: close Transfer-Encoding: chunked
2025-02-22 00:40:09 UTC	537	IN	Data Raw: 32 30 64 0d 0a 7b 22 73 63 6f 70 65 22 3a 22 2f 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 69 7a 65 73 22 3a 22 31 39 32 78 31 39 32 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 2c 22 73 72 63 22 3a 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 32 66 32 37 61 34 33 65 2d 30 31 65 39 2d 34 38 33 31 2d 39 30 33 35 2d 35 35 63 36 39 32 66 63 30 30 32 62 2f 66 61 76 69 63 6f 6e 2f 62 30 33 66 39 35 33 30 2d 61 65 62 35 2d 34 34 33 61 2d 62 39 31 37 2d 32 30 64 38 62 64 35 34 32 30 61 36 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 39 32 2c 68 3a 31 39 32 2c 6d 22 7d 2c 7b 22 73 69 7a 65 73 22 3a 22 Data Ascii: 20d{"scope":"/","start_url":"/","display":"standalone","icons":[{"sizes":"192x192","type":"image/png","src":"//img1.wsimg.com/isteam/ip/2f27a43e-01e9-4831-9035-55c692fc002b/favicon/b03f9530-aeb5-443a-b917-20d8bd5420a6.png/:/rs=w:192,h:192,m"},{"sizes":"

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:09 UTC	426	OUT	GET /blobby/go/static/radpack/@wsb/guac-widget-shared/c/_rollupPluginBabelHelpers-8ce54c82.js HTTP/1.1 Host: img1.wsimg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:10 UTC	669	IN	HTTP/1.1 200 OK Content-Type: application/javascript x-version: 0.7.3+sha-a7223ca ETag: "fadb3719ffa2a9e96cdc64ffea0220fa" Last-Modified: Tue, 13 Sep 2022 20:51:07 GMT x-amzn-trace-id: Root=1-6320ed3a-239be6cd0632f6776811c293 x-forwarded-port: 443 X-Forwarded-For: 64.202.160.104 x-forwarded-proto: https Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Cache-Control: public, max-age=31536000 Expires: Sun, 22 Feb 2026 00:40:10 GMT Date: Sat, 22 Feb 2025 00:40:10 GMT Content-Length: 586 Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: *
2025-02-22 00:40:10 UTC	586	IN	Data Raw: 64 65 66 69 6e 65 28 22 40 77 73 62 2f 67 75 61 63 2d 77 69 64 67 65 74 2d 73 68 61 72 65 64 2f 63 2f 5f 72 6f 6c 6c 75 70 50 6c 75 67 69 6e 42 61 62 65 6c 48 65 6c 70 65 72 73 2d 38 63 65 35 34 63 38 32 2e 6a 73 22 2c 5b 22 65 78 70 6f 72 74 73 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 72 65 74 75 72 6e 20 6e 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3f 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 2e 62 69 6e 64 28 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 31 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 72 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 72 29 4f 62 6a 65 63 Data Ascii: define("@wsb/guac-widget-shared/c/_rollupPluginBabelHelpers-8ce54c82.js",["exports"],(function(e){"use strict";function n(){return n=Object.assign?Object.assign.bind():function(e){for(var n=1;n<arguments.length;n++){var r=arguments[n];for(var t in r)Objec

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:10 UTC	1408	OUT	GET /t/1/tl/event?dh=geminiloguiin.godaddysites.com&dr=&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=1.0.1&vg=04b92a6d-c0a3-4e03-938c-00bddc63181e&vtg=04b92a6d-c0a3-4e03-938c-00bddc63181e&dp=%2F&trace_id=a524c808e73844d0a5471e83c2a044f7&cts=2025-02-22T00%3A40%3A05.634Z&hit_id=af82d0db-80e3-40c2-b7de-c8d678e7a8ca&ht=pageview&trfd=%7B%22ap%22%3A%22IPv2%22%2C%22websiteId%22%3A%222f27a43e-01e9-4831-9035-55c692fc002b%22%2C%22pd%22%3A%222022-11-15T07%3A23%3A28.360Z%22%2C%22meta.numWidgets%22%3A4%2C%22meta.theme%22%3A%22layout28%22%2C%22meta.headerMediaType%22%3A%22Image%22%2C%22meta.isOLS%22%3Afalse%2C%22meta.isOLA%22%3Afalse%2C%22meta.isMembership%22%3Afalse%7D&ap=IPv2&vci=1185335650&z=1125092678 HTTP/1.1 Host: events.api.secureserver.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://geminiloguiin.godaddysites.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:10 UTC	440	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Access-Control-Allow-Origin: https://geminiloguiin.godaddysites.com Access-Control-Allow-Credentials: true X-Robots-Tag: noindex, nofollow Cache-Control: private X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000 ; includeSubDomains X-Frame-Options: DENY Date: Sat, 22 Feb 2025 00:40:10 GMT Connection: close
2025-02-22 00:40:10 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:10 UTC	1789	OUT	GET /t/1/tl/event?dh=geminiloguiin.godaddysites.com&dr=&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=1.0.1&vg=04b92a6d-c0a3-4e03-938c-00bddc63181e&vtg=04b92a6d-c0a3-4e03-938c-00bddc63181e&dp=%2F&trace_id=a524c808e73844d0a5471e83c2a044f7&cts=2025-02-22T00%3A40%3A07.867Z&hit_id=be4e5cc8-db22-4851-9fb4-64f4f06f6fe9&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22IPv2%22%2C%22websiteId%22%3A%222f27a43e-01e9-4831-9035-55c692fc002b%22%2C%22pd%22%3A%222022-11-15T07%3A23%3A28.360Z%22%2C%22meta.numWidgets%22%3A4%2C%22meta.theme%22%3A%22layout28%22%2C%22meta.headerMediaType%22%3A%22Image%22%2C%22meta.isOLS%22%3Afalse%2C%22meta.isOLA%22%3Afalse%2C%22meta.isMembership%22%3Afalse%7D&ap=IPv2&vci=1185335650&z=1186392352&tce=1740184802169&tcs=1740184801683&tdc=1740184807844&tdclee=1740184805638&tdcles=1740184805637&tdi=1740184803754&tdl=1740184802305&tdle= [TRUNCATED] Host: events.api.secureserver.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://geminiloguiin.godaddysites.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:10 UTC	440	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Access-Control-Allow-Origin: https://geminiloguiin.godaddysites.com Access-Control-Allow-Credentials: true X-Robots-Tag: noindex, nofollow Cache-Control: private X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000 ; includeSubDomains X-Frame-Options: DENY Date: Sat, 22 Feb 2025 00:40:10 GMT Connection: close
2025-02-22 00:40:10 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:10 UTC	695	OUT	POST /eventbus/web?clientid=b18ef4f046435b64a469b32c3c1c20a3 HTTP/1.1 Host: csp.secureserver.net Connection: keep-alive Content-Length: 1257 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://geminiloguiin.godaddysites.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:10 UTC	1257	OUT	Data Raw: 7b 22 73 63 68 65 6d 61 49 64 22 3a 22 75 72 6e 3a 73 68 61 72 65 64 3a 75 73 65 72 3a 65 76 65 6e 74 73 3a 2f 76 31 22 2c 22 64 61 74 61 22 3a 5b 7b 22 67 6c 6f 62 61 6c 22 3a 7b 22 74 72 61 63 65 49 64 22 3a 22 61 35 32 34 63 38 30 38 65 37 33 38 34 34 64 30 61 35 34 37 31 65 38 33 63 32 61 30 34 34 66 37 22 2c 22 63 6c 69 65 6e 74 22 3a 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a Data Ascii: {"schemaId":"urn:shared:user:events:/v1","data":[{"global":{"traceId":"a524c808e73844d0a5471e83c2a044f7","client":{"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","sdk":{"name":
2025-02-22 00:40:11 UTC	525	IN	HTTP/1.1 202 Accepted Content-Type: application/json Content-Length: 0 x-amzn-requestid: 610c230a-36bb-4fe4-8f8f-fc2641726599 Access-Control-Allow-Origin: * x-amz-apigw-id: GXF0yGwvoAMEU1Q= x-amzn-trace-id: Root=1-67b91cea-5aedc72605f3c75e41b377b2 x-envoy-upstream-service-time: 282 Expires: Sat, 22 Feb 2025 00:40:11 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 22 Feb 2025 00:40:11 GMT Connection: close Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload

Timestamp	Bytes transferred	Direction	Data
2025-02-22 00:40:10 UTC	695	OUT	POST /eventbus/web?clientid=8da2217409854bee82e12dc4ca0b39fb HTTP/1.1 Host: csp.secureserver.net Connection: keep-alive Content-Length: 2067 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://geminiloguiin.godaddysites.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://geminiloguiin.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-22 00:40:10 UTC	2067	OUT	Data Raw: 7b 22 73 63 68 65 6d 61 49 64 22 3a 22 75 72 6e 3a 73 68 61 72 65 64 3a 75 73 65 72 3a 65 76 65 6e 74 73 3a 2f 76 31 22 2c 22 64 61 74 61 22 3a 5b 7b 22 67 6c 6f 62 61 6c 22 3a 7b 22 74 72 61 63 65 49 64 22 3a 22 61 35 32 34 63 38 30 38 65 37 33 38 34 34 64 30 61 35 34 37 31 65 38 33 63 32 61 30 34 34 66 37 22 2c 22 63 6c 69 65 6e 74 22 3a 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 22 2c 22 73 64 6b 22 3a 7b 22 6e 61 6d 65 22 3a Data Ascii: {"schemaId":"urn:shared:user:events:/v1","data":[{"global":{"traceId":"a524c808e73844d0a5471e83c2a044f7","client":{"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","sdk":{"name":
2025-02-22 00:40:11 UTC	524	IN	HTTP/1.1 202 Accepted Content-Type: application/json Content-Length: 0 x-amzn-requestid: 07a3338b-9f1c-4221-8f6f-220e88576462 Access-Control-Allow-Origin: * x-amz-apigw-id: GXF0wEWUIAMEvSw= x-amzn-trace-id: Root=1-67b91cea-29643be470c488af136bd8cb x-envoy-upstream-service-time: 91 Expires: Sat, 22 Feb 2025 00:40:11 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 22 Feb 2025 00:40:11 GMT Connection: close Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload