Edit tour

Windows Analysis Report
https://click.selectiveasia.com/l391pk/vx4w8gZP

Overview

General Information

Sample URL:	https://click.selectiveasia.com/l391pk/vx4w8gZP
Analysis ID:	1640768
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected Powershell download and execute

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2316,i,15611474369537140907,11828937034291286850,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2352 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.selectiveasia.com/l391pk/vx4w8gZP" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_107	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

HTTP traffic detected: POST /api/event HTTP/1.1Host: metrics.felloh.comConnection: keep-aliveContent-Length: 112sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plainsec-ch-ua-mobile: ?0Accept: */*Origin: https://pay.felloh.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://pay.felloh.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 17 Mar 2025 16:47:19 GMTContent-Type: text/htmlContent-Length: 548Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000157bf
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000157c0
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000157c1
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000157c5
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000157c8
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000157c9
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9ade54
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9ade5b
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9ade5c
Source: chromecache_122.1.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000003b9ade63
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://api.stripe.com
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://browser-intake-datadoghq.com
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://cdn.basistheory.com
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://cdn.basistheory.com;
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Inter:wght
Source: chromecache_132.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_136.1.dr, chromecache_143.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2)
Source: chromecache_136.1.dr, chromecache_143.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2)
Source: chromecache_136.1.dr, chromecache_143.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1pL7SUc.woff2)
Source: chromecache_136.1.dr, chromecache_143.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa25L7SUc.woff2)
Source: chromecache_136.1.dr, chromecache_143.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2)
Source: chromecache_136.1.dr, chromecache_143.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2)
Source: chromecache_136.1.dr, chromecache_143.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2pL7SUc.woff2)
Source: chromecache_107.1.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://http-intake.logs.datadoghq.com
Source: chromecache_132.1.dr	String found in binary or memory: https://js.basistheory.com
Source: chromecache_132.1.dr	String found in binary or memory: https://js.flock-dev.com
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://logs.browser-intake-datadoghq.com
Source: chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	String found in binary or memory: https://p.typekit.net
Source: chromecache_122.1.dr	String found in binary or memory: https://p.typekit.net/p.css?s=1&k=ofb7tyq&ht=tk&f=24561.24562.24563.24567.24570.24571.28747.28752.28
Source: chromecache_132.1.dr	String found in binary or memory: https://platform-static.meliopayments.com
Source: chromecache_132.1.dr	String found in binary or memory: https://use.typekit.net
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/0ceada/00000000000000003b9ade5c/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/0ceada/00000000000000003b9ade5c/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/0ceada/00000000000000003b9ade5c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/125ffe/0000000000000000000157c0/27/a?subset_id=2&fvd=i7&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/125ffe/0000000000000000000157c0/27/d?subset_id=2&fvd=i7&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/125ffe/0000000000000000000157c0/27/l?subset_id=2&fvd=i7&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/19c742/0000000000000000000157c9/27/a?subset_id=2&fvd=n4&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/19c742/0000000000000000000157c9/27/d?subset_id=2&fvd=n4&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/19c742/0000000000000000000157c9/27/l?subset_id=2&fvd=n4&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/277d7a/00000000000000003b9ade63/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/277d7a/00000000000000003b9ade63/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/277d7a/00000000000000003b9ade63/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/63da2e/00000000000000003b9ade54/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/63da2e/00000000000000003b9ade54/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/63da2e/00000000000000003b9ade54/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/849db4/0000000000000000000157c5/27/a?subset_id=2&fvd=n2&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/849db4/0000000000000000000157c5/27/d?subset_id=2&fvd=n2&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/849db4/0000000000000000000157c5/27/l?subset_id=2&fvd=n2&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/c12453/0000000000000000000157bf/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/c12453/0000000000000000000157bf/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/c12453/0000000000000000000157bf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/c37133/0000000000000000000157c1/27/a?subset_id=2&fvd=n3&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/c37133/0000000000000000000157c1/27/d?subset_id=2&fvd=n3&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/c37133/0000000000000000000157c1/27/l?subset_id=2&fvd=n3&v=3
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/f50b47/00000000000000003b9ade5b/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/f50b47/00000000000000003b9ade5b/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/f50b47/00000000000000003b9ade5b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/fcca1c/0000000000000000000157c8/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/fcca1c/0000000000000000000157c8/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_122.1.dr	String found in binary or memory: https://use.typekit.net/af/fcca1c/0000000000000000000157c8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443

Source: unknown	HTTPS traffic detected: 142.250.184.196:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.248.171.107:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.248.171.107:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.227.50:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.2.137:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.169.164.183:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.221.110.26:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.100.106:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.169.164.183:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.146:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.98.35:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.99.90:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.27.84:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.27.84:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.98.125:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.3.60:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.27.42:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.27.42:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.245.60.86:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.99.53:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.245.60.59:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.60:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.60:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.60:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.60:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.60:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.60:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.195.249:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.2.60:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.195.249:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.227.50:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.167.227.129:443 -> 192.168.2.4:49815 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7100_1977216650

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7100_1977216650

Jump to behavior

Source: classification engine

Classification label: mal48.evad.win@23/135@46/22

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2316,i,15611474369537140907,11828937034291286850,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2352 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://click.selectiveasia.com/l391pk/vx4w8gZP"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2316,i,15611474369537140907,11828937034291286850,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2352 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: dropped/chromecache_107, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://click.selectiveasia.com/l391pk/vx4w8gZP	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://pay.felloh.com/static/js/main.24c9e005.js	0%	Avira URL Cloud	safe
https://analytics.felloh.com/decide/?v=3&ip=1&_=1742230031010&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230076210&ver=1.82.3	0%	Avira URL Cloud	safe
https://cdn.basistheory.com;	0%	Avira URL Cloud	safe
https://enums.api.felloh.com/	0%	Avira URL Cloud	safe
https://o1366283.ingest.sentry.io/api/6712389/envelope/?sentry_key=0bef2ad578304143b54c97cd73f30ccf&sentry_version=7&sentry_client=sentry.javascript.react%2F7.29.0	0%	Avira URL Cloud	safe
https://analytics.felloh.com/decide/?v=3&ip=1&_=1742230032564&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230070180&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230067164&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/static/recorder-v2.js?v=1.82.3	0%	Avira URL Cloud	safe
https://metrics.felloh.com/api/event	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230082242&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/e/?ip=1&_=1742230031009&ver=1.82.3	0%	Avira URL Cloud	safe
https://cdn.basistheory.com	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230037078&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230049113&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230046110&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230097305&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230061151&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230079226&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230058133&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230032493&ver=1.82.3	0%	Avira URL Cloud	safe
https://metrics.felloh.com/js/script.js	0%	Avira URL Cloud	safe
https://pay.felloh.com/favicon.ico	0%	Avira URL Cloud	safe
https://assets.felloh.com/organisation/9203.png	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230073195&ver=1.82.3	0%	Avira URL Cloud	safe
https://js.flock-dev.com	0%	Avira URL Cloud	safe
https://platform-static.meliopayments.com	0%	Avira URL Cloud	safe
https://pay.felloh.com/manifest.json	0%	Avira URL Cloud	safe
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230088258&ver=1.82.3	0%	Avira URL Cloud	safe
https://pay.felloh.com/static/css/main.f51e9202.css	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230055129&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230088259&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230058134&ver=1.82.3	0%	Avira URL Cloud	safe
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230100320&ver=1.82.3	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
js.basistheory.com	104.18.3.60	true	false	high
metrics.felloh.com	18.169.164.183	true	false	unknown
d5qkhrtiv3k8u.cloudfront.net	13.32.27.84	true	false	unknown
d3so067gs66lhr.cloudfront.net	18.245.60.86	true	false	unknown
enums.api.felloh.com	143.204.98.35	true	false	unknown
cdn.lr-in.com	172.67.213.146	true	false	high
a1874.dscg1.akamai.net	2.16.100.106	true	false	high
code.jquery.com	151.101.2.137	true	false	high
d1xd96hgm1cz1b.cloudfront.net	3.167.227.50	true	false	unknown
o1366283.ingest.sentry.io	34.120.195.249	true	false	unknown
payment.api.felloh.com	13.32.99.90	true	false	unknown
www.google.com	142.250.184.196	true	false	high
track.mail.selectiveasia.com	192.248.171.107	true	false	unknown
a1988.dscg1.akamai.net	88.221.110.26	true	false	high
assets.felloh.com	unknown	unknown	false	unknown
use.typekit.net	unknown	unknown	false	high
click.selectiveasia.com	unknown	unknown	false	unknown
pay.felloh.com	unknown	unknown	false	unknown
analytics.felloh.com	unknown	unknown	false	unknown
p.typekit.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://click.selectiveasia.com/l391pk/vx4w8gZP	false		unknown
https://js.basistheory.com/hosted-elements/_next/static/chunks/105-46253cde6eae0499.js	false		high
https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=1005d2ac-41bd-4231-80c4-52a50cd1aa6f	false		high
https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=d7483827-8834-41d7-8715-b745cc629e88	false		high
https://analytics.felloh.com/decide/?v=3&ip=1&_=1742230031010&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://cdn.lr-in.com/logger-1.min.js	false		high
https://js.basistheory.com/hosted-elements/_next/static/chunks/570-43de667d6cb61c2b.js	false		high
https://js.basistheory.com/hosted-elements/_next/static/hO3E3L70aRSmrnrBBDUQj/_buildManifest.js	false		high
https://js.basistheory.com/hosted-elements/_next/static/hO3E3L70aRSmrnrBBDUQj/_middlewareManifest.js	false		high
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230070180&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://js.basistheory.com/hosted-elements/_next/static/chunks/699-d94eae0b845fede1.js	false		high
https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=5467eef2-f099-4951-ac07-6e977010bab6	false		high
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230067164&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://pay.felloh.com/static/js/main.24c9e005.js	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230076210&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://enums.api.felloh.com/	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/decide/?v=3&ip=1&_=1742230032564&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://o1366283.ingest.sentry.io/api/6712389/envelope/?sentry_key=0bef2ad578304143b54c97cd73f30ccf&sentry_version=7&sentry_client=sentry.javascript.react%2F7.29.0	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/static/recorder-v2.js?v=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230082242&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://js.basistheory.com/elements/v1/index.js	false		high
https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=4e66daf1-575d-4142-bd79-3f633dea843b	false		high
https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	false		unknown
https://metrics.felloh.com/api/event	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/e/?ip=1&_=1742230031009&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230061151&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230097305&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230049113&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230037078&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230046110&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230079226&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230058133&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.slim.min.js	false		high
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230032493&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230073195&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://assets.felloh.com/organisation/9203.png	false	Avira URL Cloud: safe	unknown
https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=8f0cd065-aa71-462e-bd90-891c70ee0c55	false		high
https://js.basistheory.com/hosted-elements/_next/static/chunks/pages/elements/card-number-element-9f48d425a449560d.js	false		high
https://metrics.felloh.com/js/script.js	false	Avira URL Cloud: safe	unknown
https://pay.felloh.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://js.basistheory.com/hosted-elements/_next/static/chunks/main-6f7ef630b17328ac.js	false		high
https://js.basistheory.com/hosted-elements/_next/static/hO3E3L70aRSmrnrBBDUQj/_ssgManifest.js	false		high
https://js.basistheory.com/hosted-elements/_next/static/chunks/pages/elements/card-verification-code-element-ed5180847a58b75b.js	false		high
https://analytics.felloh.com/e/?compression=gzip-js&ip=1&_=1742230088258&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://js.basistheory.com/hosted-elements/elements/card-verification-code-element.html?element_id=319c99f0-9417-4fbc-a130-8a0703216e43	false		high
https://js.basistheory.com/hosted-elements/_next/static/chunks/webpack-5d2eec35c56fcf78.js	false		high
https://pay.felloh.com/manifest.json	false	Avira URL Cloud: safe	unknown
https://p.typekit.net/p.css?s=1&k=ofb7tyq&ht=tk&f=24561.24562.24563.24567.24570.24571.28747.28752.28755.28762&a=44397402&app=typekit&e=css	false		high
https://pay.felloh.com/static/css/main.f51e9202.css	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230055129&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230058134&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://js.basistheory.com/hosted-elements/elements/card-number-element.html?element_id=8838220e-319b-490a-af3a-7d7ebb55427a	false		high
https://use.typekit.net/ofb7tyq.css	false		high
https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=b1b13ba1-72ab-46ac-adaa-12e48fee5a29	false		high
https://js.basistheory.com/hosted-elements/fonts/conceal/conceal.css	false		high
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230088259&ver=1.82.3	false	Avira URL Cloud: safe	unknown
https://analytics.felloh.com/s/?compression=gzip-js&ip=1&_=1742230100320&ver=1.82.3	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://p.typekit.net	chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	false		high
https://use.typekit.net/af/125ffe/0000000000000000000157c0/27/a?subset_id=2&fvd=i7&v=3	chromecache_122.1.dr	false		high
https://use.typekit.net/af/849db4/0000000000000000000157c5/27/l?subset_id=2&fvd=n2&v=3	chromecache_122.1.dr	false		high
https://cdn.basistheory.com;	chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/af/19c742/0000000000000000000157c9/27/l?subset_id=2&fvd=n4&v=3	chromecache_122.1.dr	false		high
http://typekit.com/eulas/00000000000000003b9ade63	chromecache_122.1.dr	false		high
https://api.stripe.com	chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	false		high
https://use.typekit.net/af/c12453/0000000000000000000157bf/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net/af/849db4/0000000000000000000157c5/27/d?subset_id=2&fvd=n2&v=3	chromecache_122.1.dr	false		high
https://use.typekit.net/af/fcca1c/0000000000000000000157c8/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
http://typekit.com/eulas/0000000000000000000157bf	chromecache_122.1.dr	false		high
https://p.typekit.net/p.css?s=1&k=ofb7tyq&ht=tk&f=24561.24562.24563.24567.24570.24571.28747.28752.28	chromecache_122.1.dr	false		high
http://typekit.com/eulas/00000000000000003b9ade5b	chromecache_122.1.dr	false		high
http://typekit.com/eulas/00000000000000003b9ade5c	chromecache_122.1.dr	false		high
http://typekit.com/eulas/0000000000000000000157c1	chromecache_122.1.dr	false		high
http://typekit.com/eulas/0000000000000000000157c0	chromecache_122.1.dr	false		high
https://cdn.basistheory.com	chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	false	Avira URL Cloud: safe	unknown
http://typekit.com/eulas/0000000000000000000157c9	chromecache_122.1.dr	false		high
http://typekit.com/eulas/0000000000000000000157c8	chromecache_122.1.dr	false		high
http://typekit.com/eulas/0000000000000000000157c5	chromecache_122.1.dr	false		high
http://typekit.com/eulas/00000000000000003b9ade54	chromecache_122.1.dr	false		high
https://use.typekit.net/af/277d7a/00000000000000003b9ade63/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net/af/c12453/0000000000000000000157bf/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net/af/63da2e/00000000000000003b9ade54/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://logs.browser-intake-datadoghq.com	chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	false		high
https://use.typekit.net/af/c12453/0000000000000000000157bf/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://platform-static.meliopayments.com	chromecache_132.1.dr	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/af/19c742/0000000000000000000157c9/27/a?subset_id=2&fvd=n4&v=3	chromecache_122.1.dr	false		high
https://use.typekit.net/af/f50b47/00000000000000003b9ade5b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_107.1.dr	false		high
https://use.typekit.net/af/63da2e/00000000000000003b9ade54/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net/af/c37133/0000000000000000000157c1/27/a?subset_id=2&fvd=n3&v=3	chromecache_122.1.dr	false		high
https://use.typekit.net/af/fcca1c/0000000000000000000157c8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net	chromecache_132.1.dr	false		high
https://js.basistheory.com	chromecache_132.1.dr	false		high
https://browser-intake-datadoghq.com	chromecache_92.1.dr, chromecache_126.1.dr, chromecache_102.1.dr, chromecache_133.1.dr, chromecache_128.1.dr, chromecache_148.1.dr, chromecache_119.1.dr, chromecache_160.1.dr, chromecache_132.1.dr	false		high
https://use.typekit.net/af/0ceada/00000000000000003b9ade5c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net/af/277d7a/00000000000000003b9ade63/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://js.flock-dev.com	chromecache_132.1.dr	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/af/849db4/0000000000000000000157c5/27/a?subset_id=2&fvd=n2&v=3	chromecache_122.1.dr	false		high
https://use.typekit.net/af/0ceada/00000000000000003b9ade5c/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net/af/fcca1c/0000000000000000000157c8/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high
https://use.typekit.net/af/f50b47/00000000000000003b9ade5b/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8	chromecache_122.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.169.164.183	metrics.felloh.com	United States	3	MIT-GATEWAYSUS	false
172.67.213.146	cdn.lr-in.com	United States	13335	CLOUDFLARENETUS	false
104.18.2.60	unknown	United States	13335	CLOUDFLARENETUS	false
3.167.227.129	unknown	United States	16509	AMAZON-02US	false
143.204.98.35	enums.api.felloh.com	United States	16509	AMAZON-02US	false
18.245.60.59	unknown	United States	16509	AMAZON-02US	false
88.221.110.26	a1988.dscg1.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
2.16.100.106	a1874.dscg1.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
143.204.98.125	unknown	United States	16509	AMAZON-02US	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
13.32.99.90	payment.api.felloh.com	United States	16509	AMAZON-02US	false
13.32.27.112	unknown	United States	7018	ATT-INTERNET4US	false
13.32.27.84	d5qkhrtiv3k8u.cloudfront.net	United States	7018	ATT-INTERNET4US	false
13.32.27.42	unknown	United States	7018	ATT-INTERNET4US	false
192.248.171.107	track.mail.selectiveasia.com	France	20473	AS-CHOOPAUS	false
13.32.99.53	unknown	United States	16509	AMAZON-02US	false
104.18.3.60	js.basistheory.com	United States	13335	CLOUDFLARENETUS	false
3.167.227.50	d1xd96hgm1cz1b.cloudfront.net	United States	16509	AMAZON-02US	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
18.245.60.86	d3so067gs66lhr.cloudfront.net	United States	16509	AMAZON-02US	false
34.120.195.249	o1366283.ingest.sentry.io	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640768
Start date and time:	2025-03-17 17:46:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://click.selectiveasia.com/l391pk/vx4w8gZP
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.evad.win@23/135@46/22
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.206, 142.250.186.131, 66.102.1.84, 142.250.186.78, 216.58.206.46, 172.217.18.14, 142.250.186.174, 142.250.185.142, 172.217.16.202, 172.217.18.3, 2.23.77.188, 142.250.186.74, 142.250.184.234, 172.217.16.138, 142.250.185.106, 142.250.185.138, 142.250.186.170, 142.250.185.234, 142.250.185.202, 142.250.186.106, 142.250.184.202, 172.217.18.106, 142.250.185.170, 172.217.18.10, 142.250.186.138, 142.250.185.74, 216.58.206.74, 172.217.23.106, 142.250.74.202, 142.250.186.42, 142.250.181.234, 216.58.212.170, 216.58.206.42, 142.250.185.78, 142.250.186.110, 142.250.64.110, 173.194.7.38, 142.250.184.206, 142.251.40.206, 142.250.185.238, 142.250.185.131, 216.58.206.35, 142.250.186.142, 23.60.203.209, 20.109.210.53
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, r1.sn-p5qddn76.gvt1.com, r1---sn-p5qddn76.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://click.selectiveasia.com/l391pk/vx4w8gZP

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65241)
Category:	downloaded
Size (bytes):	72372
Entropy (8bit):	5.290300080184882
Encrypted:	false
SSDEEP:	1536:lDFXTROYFbeDtyZxg6V4mMeexs1Lzu3JlQ5uCe/ZiEm9W3NBygWsKXEaJTQ47GKq:PuIy3JlQ5cLhWtJTQ47GKq
MD5:	1276065911521C5C22037A31365D179D
SHA1:	D1C6704E94EFE2D465FC161B6381E127D35ACD81
SHA-256:	BBB7B9921CA2B61948753A6EDB63C78443663DC45D1621D18E102E1DCB34E512
SHA-512:	E8E456257FCBAE74A3073C1E7DD354C8B08C4C8B06A0D3FA35FB4CCB65009B52419BA3D16423B577B387052B56A551592CEF917AB4EFA97FD9F660457C2259E0
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.6.0.slim.min.js
Preview:	/! jQuery v3.6.0 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/Tween,-effects/animatedSelector \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(g,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,v=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),m={},b=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},w=g.document,c={type:!0,src:!0,nonce:!0,noModule:!0

Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/card-number-element.html?element_id=8838220e-319b-490a-af3a-7d7ebb55427a
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/card-expiration-date-element.html?element_id=be4ba258-2a13-4db0-a3ea-176bdc267da9
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/card-verification-code-element.html?element_id=319c99f0-9417-4fbc-a130-8a0703216e43
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=5467eef2-f099-4951-ac07-6e977010bab6
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=b1b13ba1-72ab-46ac-adaa-12e48fee5a29
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=8f0cd065-aa71-462e-bd90-891c70ee0c55
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=1005d2ac-41bd-4231-80c4-52a50cd1aa6f
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=d7483827-8834-41d7-8715-b745cc629e88
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=4e66daf1-575d-4142-bd79-3f633dea843b
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/card-number-element.html?element_id=8838220e-319b-490a-af3a-7d7ebb55427a
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/card-expiration-date-element.html?element_id=be4ba258-2a13-4db0-a3ea-176bdc267da9
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/card-verification-code-element.html?element_id=319c99f0-9417-4fbc-a130-8a0703216e43
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=5467eef2-f099-4951-ac07-6e977010bab6
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=b1b13ba1-72ab-46ac-adaa-12e48fee5a29
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=8f0cd065-aa71-462e-bd90-891c70ee0c55
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=1005d2ac-41bd-4231-80c4-52a50cd1aa6f
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=d7483827-8834-41d7-8715-b745cc629e88
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: Iframe src: https://js.basistheory.com/hosted-elements/elements/data-element.html?element_id=4e66daf1-575d-4142-bd79-3f633dea843b

Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: No <meta name="author".. found
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: No <meta name="author".. found

Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: No <meta name="copyright".. found
Source: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea	HTTP Parser: No <meta name="copyright".. found

Source: global traffic	TCP traffic: 192.168.2.4:50123 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:50038 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.36

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: click.selectiveasia.com
Source: global traffic	DNS traffic detected: DNS query: pay.felloh.com
Source: global traffic	DNS traffic detected: DNS query: use.typekit.net
Source: global traffic	DNS traffic detected: DNS query: metrics.felloh.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: p.typekit.net
Source: global traffic	DNS traffic detected: DNS query: cdn.lr-in.com
Source: global traffic	DNS traffic detected: DNS query: analytics.felloh.com
Source: global traffic	DNS traffic detected: DNS query: enums.api.felloh.com
Source: global traffic	DNS traffic detected: DNS query: payment.api.felloh.com
Source: global traffic	DNS traffic detected: DNS query: js.basistheory.com
Source: global traffic	DNS traffic detected: DNS query: assets.felloh.com
Source: global traffic	DNS traffic detected: DNS query: o1366283.ingest.sentry.io

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 17:47:02.183023930 CET	53	59991	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:02.448695898 CET	53	62432	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:03.875969887 CET	53	62745	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:03.988441944 CET	53	50414	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:06.306375027 CET	60313	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:06.306500912 CET	53887	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:06.313184977 CET	53	53887	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:06.313199043 CET	53	60313	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:07.513372898 CET	50969	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:07.513556957 CET	61927	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:07.526000977 CET	53	61927	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:07.529258013 CET	53	50969	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:08.415556908 CET	62823	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:08.415616035 CET	55285	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:08.453958988 CET	53	55285	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:08.455342054 CET	53	62823	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:09.644515991 CET	63137	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:09.644884109 CET	49756	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:09.645291090 CET	60965	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:09.645443916 CET	50975	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:09.646308899 CET	60943	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:09.646466970 CET	54884	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:09.652148962 CET	53	63137	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:09.652610064 CET	53	49756	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:09.653184891 CET	53	54884	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:09.653382063 CET	53	60943	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:09.673361063 CET	53	50975	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:09.675012112 CET	53	60965	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:10.837047100 CET	62138	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:10.837527037 CET	64973	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:10.843877077 CET	53	62138	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:10.845571041 CET	53	64973	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:10.928287029 CET	53	56019	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.102181911 CET	59933	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.102900982 CET	54277	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.106497049 CET	58190	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.106820107 CET	50573	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.109934092 CET	53	59933	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.112195015 CET	53	54277	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.134490967 CET	51402	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.134861946 CET	53478	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.144263983 CET	53	58190	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.149036884 CET	53	50573	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.176018000 CET	53	53478	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.188666105 CET	53	51402	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.190006971 CET	59587	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.190130949 CET	57848	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:12.222418070 CET	53	57848	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:12.234375954 CET	53	59587	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.394784927 CET	61676	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.395039082 CET	60734	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.415848017 CET	53	60734	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.447107077 CET	53	61676	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.474492073 CET	65484	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.474816084 CET	62889	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.507448912 CET	53	65484	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.524287939 CET	53	62889	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.601627111 CET	51356	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.601773024 CET	62169	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.611253023 CET	53	62169	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.613101006 CET	53	51356	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.666703939 CET	53218	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.667005062 CET	57645	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.697714090 CET	53	57645	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.699764967 CET	53	53218	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.769206047 CET	49998	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.769350052 CET	52695	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:13.786014080 CET	53	52695	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:13.796403885 CET	53	49998	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:14.705054045 CET	53028	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:14.705245018 CET	61548	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:14.730451107 CET	53	61548	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:14.747447014 CET	53	53028	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:15.282378912 CET	51550	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:15.282780886 CET	57563	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:15.292977095 CET	53	51550	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:15.293921947 CET	53	57563	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:15.409970999 CET	53	52729	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:15.946330070 CET	53	52809	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:17.146776915 CET	49725	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:17.147088051 CET	64833	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:17.190905094 CET	53	64833	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:17.194802046 CET	53	49725	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:18.928771973 CET	63671	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:18.928910017 CET	55057	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:19.003597021 CET	53	55057	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:19.019983053 CET	53	63671	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:19.458012104 CET	53	50903	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:21.011404037 CET	53	58680	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:21.087815046 CET	59498	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:21.088213921 CET	54927	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:47:21.105180025 CET	53	54927	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:21.128946066 CET	53	59498	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:25.048536062 CET	53	58463	1.1.1.1	192.168.2.4
Mar 17, 2025 17:47:43.187639952 CET	53	57303	1.1.1.1	192.168.2.4
Mar 17, 2025 17:48:02.004226923 CET	53	56408	1.1.1.1	192.168.2.4
Mar 17, 2025 17:48:04.676613092 CET	53	55536	1.1.1.1	192.168.2.4
Mar 17, 2025 17:48:11.264988899 CET	138	138	192.168.2.4	192.168.2.255
Mar 17, 2025 17:48:15.387204885 CET	57777	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:48:15.387352943 CET	58742	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:48:15.412270069 CET	53	58742	1.1.1.1	192.168.2.4
Mar 17, 2025 17:48:15.413656950 CET	53	57777	1.1.1.1	192.168.2.4
Mar 17, 2025 17:48:16.737396002 CET	52022	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:48:16.737529039 CET	60933	53	192.168.2.4	1.1.1.1
Mar 17, 2025 17:48:16.761626959 CET	53	60933	1.1.1.1	192.168.2.4
Mar 17, 2025 17:48:16.776624918 CET	53	52022	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:08 UTC	688	OUT	GET /l391pk/vx4w8gZP HTTP/1.1 Host: click.selectiveasia.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:08 UTC	668	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache Content-Security-Policy: child-src 'self'; connect-src 'self'; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src 'self'; style-src 'self' https: 'unsafe-inline' Location: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea Server: Caddy X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: sameorigin X-Permitted-Cross-Domain-Policies: none X-Request-Id: 6ca9e626-1fb3-40b0-acbd-644c6e2d0967 X-Runtime: 0.005333 X-Xss-Protection: 1; mode=block Date: Mon, 17 Mar 2025 16:47:08 GMT Connection: close Transfer-Encoding: chunked
2025-03-17 16:47:08 UTC	80	IN	Data Raw: 34 61 0d 0a 52 65 64 69 72 65 63 74 65 64 20 74 6f 3a 20 68 74 74 70 73 3a 2f 2f 70 61 79 2e 66 65 6c 6c 6f 68 2e 63 6f 6d 2f 38 35 64 38 34 35 64 33 2d 30 32 36 39 2d 34 31 37 37 2d 61 35 66 39 2d 36 61 34 35 34 36 39 31 38 30 65 61 0d 0a Data Ascii: 4aRedirected to: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea
2025-03-17 16:47:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:09 UTC	700	OUT	GET /85d845d3-0269-4177-a5f9-6a45469180ea HTTP/1.1 Host: pay.felloh.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:09 UTC	486	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 1077 Connection: close Date: Mon, 17 Mar 2025 16:47:10 GMT Cache-Control: no-cache,max-age=0 Content-Encoding: gzip Last-Modified: Thu, 23 Jan 2025 00:23:32 GMT ETag: "eb42794d17d91a65cc17e44ff6b5eb95" Server: AmazonS3 X-Cache: Error from cloudfront Via: 1.1 a6cf64e69a19d3b39479c6c39a829974.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P11 X-Amz-Cf-Id: EMXnUFIK4GGwyr6ugKjXqbFxbMg5FZE8ZW_IWj44Cbv0LdTWKeyQyQ==
2025-03-17 16:47:09 UTC	1077	IN	Data Raw: 1f 8b 08 00 00 00 00 00 02 03 95 56 ef 6f db 36 10 fd 57 18 6e 28 6c c0 92 6c 6f 69 17 d7 32 90 64 c9 92 61 dd 82 24 d8 0f 14 fd 40 93 27 8b 09 45 aa 24 e5 54 73 f3 bf ef 48 39 8e 9d ad 9b e7 0f b6 48 be 7b 77 f7 f8 48 79 7a 20 0c f7 6d 0d a4 f4 95 9a 4d c3 37 51 4c 2f 72 0a 9a e2 18 98 98 4d 2b f0 8c f0 92 59 07 3e a7 8d 2f 92 ef 68 36 9b 2a a9 ef 89 05 95 53 c9 8d a6 a4 b4 50 e4 34 2b d8 32 8c 53 fc 0a a8 18 ac 59 05 39 5d 4a 78 a8 8d f5 94 e0 ba 07 8d 64 0f 52 f8 32 17 80 21 90 c4 c1 40 6a e9 25 53 89 e3 4c 41 3e 7a c1 e1 4b a8 20 e1 46 19 bb 45 f3 d5 30 7e 5e 60 05 38 6e 65 ed 65 a8 6e 83 2d 40 29 53 1e 90 d3 12 f8 bd 69 fc 6e 2b ce b7 0a 5c 09 e0 9f 1a 2a bd af dd 24 cb 1a 07 69 90 ea 5e fa 54 83 cf 4c 31 7f e3 db 8f 29 77 6e 97 82 d5 b5 82 c4 9b 86 Data Ascii: Vo6Wn(lloi2da$@'E$TsH9H{wHyz mM7QL/rM+Y>/h6SP4+2SY9]JxdR2!@j%SLA>zK FE0~^`8neen-@)Sin+\$i^TL1)wn

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:10 UTC	573	OUT	GET /jquery-3.6.0.slim.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive Origin: https://pay.felloh.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:10 UTC	612	IN	HTTP/1.1 200 OK Connection: close Content-Length: 72372 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-11ab4" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1932931 Date: Mon, 17 Mar 2025 16:47:10 GMT X-Served-By: cache-lga21977-LGA, cache-ewr-kewr1740038-EWR X-Cache: HIT, HIT X-Cache-Hits: 309, 0 X-Timer: S1742230030.170989,VS0,VE1 Vary: Accept-Encoding
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 2d 61 6a 61 78 2c 2d 61 6a 61 78 2f 6a 73 6f 6e 70 2c 2d 61 6a 61 78 2f 6c 6f 61 64 2c 2d 61 6a 61 78 2f 73 63 72 69 70 74 2c 2d 61 6a 61 78 2f 76 61 72 2f 6c 6f 63 61 74 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 64 65 70 72 65 63 61 74 65 64 2f 61 6a 61 78 2d 65 76 65 6e 74 2d 61 6c 69 61 73 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 Data Ascii: /*! jQuery v3.6.0 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/Tween,-effects/animatedSelector \| (c) OpenJS Foundation and oth
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 64 65 70 72 65 63 61 74 65 64 2f 61 6a 61 78 2d 65 76 65 6e 74 2d 61 6c 69 61 73 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 22 2c 45 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 45 2e 66 6e 2e 69 6e 69 74 28 65 2c 74 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 7b 76 61 72 20 74 3d 21 21 65 26 26 22 6c 65 6e 67 74 68 22 69 6e 20 65 26 26 65 2e 6c 65 6e 67 74 68 2c 6e 3d 54 28 65 29 3b 72 65 74 75 72 6e 21 Data Ascii: ion,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/Tween,-effects/animatedSelector",E=function(e,t){return new E.fn.init(e,t)};function d(e){var t=!!e&&"length"in e&&e.length,n=T(e);return!
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 75 26 26 28 61 3d 74 68 69 73 2c 73 2d 2d 29 3b 73 3c 75 3b 73 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 29 29 66 6f 72 28 74 20 69 6e 20 65 29 72 3d 65 5b 74 5d 2c 22 5f 5f 70 72 6f 74 6f 5f 5f 22 21 3d 3d 74 26 26 61 21 3d 3d 72 26 26 28 6c 26 26 72 26 26 28 45 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 72 29 7c 7c 28 69 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 29 29 3f 28 6e 3d 61 5b 74 5d 2c 6f 3d 69 26 26 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 3f 5b 5d 3a 69 7c 7c 45 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 6e 29 3f 6e 3a 7b 7d 2c 69 3d 21 31 2c 61 5b 74 5d 3d 45 2e 65 78 74 65 6e 64 28 6c 2c 6f 2c 72 29 29 3a 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 61 5b 74 5d 3d 72 29 29 3b 72 65 74 Data Ascii: u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(E.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|E.isPlainObject(n)?n:{},i=!1,a[t]=E.extend(l,o,r)):void 0!==r&&(a[t]=r));ret
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 72 74 3a 6d 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 45 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 74 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 45 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 6e 5b 22 5b 6f 62 6a 65 63 74 20 22 2b 74 2b 22 5d 22 5d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 3b 76 61 72 20 70 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 2c 70 2c 78 2c 6f 2c 69 2c 68 2c 66 2c 67 Data Ascii: rt:m}),"function"==typeof Symbol&&(E.fn[Symbol.iterator]=t[Symbol.iterator]),E.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var p=function(n){var e,p,x,o,i,h,f,g
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 52 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 52 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 52 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 52 2b 22 2a 5c 5c 29 7c 29 22 2c 22 69 22 29 2c 62 6f 6f 6c 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 22 2b 49 2b 22 29 24 22 2c 22 69 22 29 2c 6e 65 65 64 73 43 6f 6e 74 65 78 74 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 52 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f 3a 5c 5c 28 22 2b 52 2b 22 2a 28 28 3f 3a 2d 5c 5c 64 29 3f 5c 5c Data Ascii: \|last\|nth\|nth-last)-(child\|of-type)(?:\\("+R+"(even\|odd\|(([+-]\|)(\\d)n\|)"+R+"(?:([+-]\|)"+R+"(\\d+)\|))"+R+"\\)\|)","i"),bool:new RegExp("^(?:"+I+")$","i"),needsContext:new RegExp("^"+R+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?:\\("+R+"*((?:-\\d)?\\
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 28 69 29 29 29 72 65 74 75 72 6e 20 6e 3b 69 66 28 61 2e 69 64 3d 3d 3d 69 29 72 65 74 75 72 6e 20 6e 2e 70 75 73 68 28 61 29 2c 6e 7d 65 6c 73 65 20 69 66 28 66 26 26 28 61 3d 66 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 69 29 29 26 26 79 28 65 2c 61 29 26 26 61 2e 69 64 3d 3d 3d 69 29 72 65 74 75 72 6e 20 6e 2e 70 75 73 68 28 61 29 2c 6e 7d 65 6c 73 65 7b 69 66 28 75 5b 32 5d 29 72 65 74 75 72 6e 20 4f 2e 61 70 70 6c 79 28 6e 2c 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 74 29 29 2c 6e 3b 69 66 28 28 69 3d 75 5b 33 5d 29 26 26 70 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 72 65 74 75 72 6e 20 4f 2e 61 70 70 6c 79 28 Data Ascii: (i)))return n;if(a.id===i)return n.push(a),n}else if(f&&(a=f.getElementById(i))&&y(e,a)&&a.id===i)return n.push(a),n}else{if(u[2])return O.apply(n,e.getElementsByTagName(t)),n;if((i=u[3])&&p.getElementsByClassName&&e.getElementsByClassName)return O.apply(
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 69 6f 6e 20 68 65 28 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 22 3d 3d 3d 74 7c 7c 22 62 75 74 74 6f 6e 22 3d 3d 3d 74 29 26 26 65 2e 74 79 70 65 3d 3d 3d 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 65 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 21 31 3d 3d 3d 65 2e 64 69 73 61 62 6c 65 64 3f 22 6c 61 62 65 6c 22 69 6e 20 65 3f 22 6c 61 62 65 6c 22 69 6e 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 74 3a 65 2e 64 69 73 61 Data Ascii: ion he(n){return function(e){var t=e.nodeName.toLowerCase();return("input"===t\|\|"button"===t)&&e.type===n}}function ge(t){return function(e){return"form"in e?e.parentNode&&!1===e.disabled?"label"in e?"label"in e.parentNode?e.parentNode.disabled===t:e.disa
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 68 7d 29 2c 70 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 4a 2e 74 65 73 74 28 54 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 2c 70 2e 67 65 74 42 79 49 64 3d 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 41 2c 21 54 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 54 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 41 29 2e 6c 65 6e 67 74 68 7d 29 2c 70 2e 67 65 74 42 79 49 64 3f 28 78 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 Data Ascii: h}),p.getElementsByClassName=J.test(T.getElementsByClassName),p.getById=ce(function(e){return a.appendChild(e).id=A,!T.getElementsByName\|\|!T.getElementsByName(A).length}),p.getById?(x.filter.ID=function(e){var t=e.replace(te,ne);return function(e){return
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 20 69 64 3d 27 22 2b 41 2b 22 2d 5c 72 5c 5c 27 20 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 3d 27 27 3e 3c 6f 70 74 69 6f 6e 20 73 65 6c 65 63 74 65 64 3d 27 27 3e 3c 2f 6f 70 74 69 6f 6e 3e 3c 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 5e 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 26 26 76 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 52 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 52 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 49 2b 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 Data Ascii: id='"+A+"-\r\\' msallowcapture=''><option selected=''></option></select>",e.querySelectorAll("[msallowcapture^='']").length&&v.push("[^$]="+R+"(?:''\|\"\")"),e.querySelectorAll("[selected]").length\|\|v.push("\\["+R+"*(?:value\|"+I+")"),e.querySelectorAll(
2025-03-17 16:47:10 UTC	1378	IN	Data Raw: 29 2c 73 3d 73 2e 6c 65 6e 67 74 68 26 26 6e 65 77 20 52 65 67 45 78 70 28 73 2e 6a 6f 69 6e 28 22 7c 22 29 29 2c 74 3d 4a 2e 74 65 73 74 28 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 29 2c 79 3d 74 7c 7c 4a 2e 74 65 73 74 28 61 2e 63 6f 6e 74 61 69 6e 73 29 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 3f 65 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3a 65 2c 72 3d 74 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 Data Ascii: ),s=s.length&&new RegExp(s.join("\|")),t=J.test(a.compareDocumentPosition),y=t\|\|J.test(a.contains)?function(e,t){var n=9===e.nodeType?e.documentElement:e,r=t&&t.parentNode;return e===r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.compareDocumentPosi

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:10 UTC	534	OUT	GET /js/script.js HTTP/1.1 Host: metrics.felloh.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:10 UTC	330	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 17 Mar 2025 16:47:10 GMT Content-Type: application/javascript Content-Length: 1346 Connection: close access-control-allow-origin: * cache-control: public, max-age=86400, must-revalidate cross-origin-resource-policy: cross-origin x-content-type-options: nosniff
2025-03-17 16:47:10 UTC	1346	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2c 72 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2c 6f 3d 72 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2c 6c 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 61 70 69 22 29 7c 7c 6e 65 77 20 55 52 4c 28 6f 2e 73 72 63 29 2e 6f 72 69 67 69 6e 2b 22 2f 61 70 69 2f 65 76 65 6e 74 22 3b 66 75 6e 63 74 69 6f 6e 20 73 28 74 2c 65 29 7b 74 26 26 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 49 67 6e 6f 72 69 6e 67 20 45 76 65 6e 74 3a 20 22 2b 74 29 2c 65 26 26 65 2e 63 61 6c 6c 62 61 63 6b 26 26 65 2e 63 61 6c 6c 62 61 63 6b 28 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 69 66 28 2f 5e 6c 6f 63 61 Data Ascii: !function(){"use strict";var a=window.location,r=window.document,o=r.currentScript,l=o.getAttribute("data-api")\|\|new URL(o.src).origin+"/api/event";function s(t,e){t&&console.warn("Ignoring Event: "+t),e&&e.callback&&e.callback()}function t(t,e){if(/^loca

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:10 UTC	598	OUT	GET /static/css/main.f51e9202.css HTTP/1.1 Host: pay.felloh.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:10 UTC	489	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4997 Connection: close Date: Mon, 17 Mar 2025 16:47:11 GMT Cache-Control: max-age=31536000,public Content-Encoding: gzip Last-Modified: Thu, 23 Jan 2025 00:23:34 GMT ETag: "5f811335b871f108be7b62c7e0691679" Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 27331d40ce87c331f48276ef8195d14c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P11 X-Amz-Cf-Id: rx2t_WozEof8Uaa_kH-NhAXQ5u8MX94aJEggRX1VyIdnHgHd4IHILQ==
2025-03-17 16:47:10 UTC	4997	IN	Data Raw: 1f 8b 08 00 00 00 00 00 02 03 d5 3c fb 8f e3 36 7a bf e7 af d0 ed 62 3a eb 3d 53 23 cb 96 ed 91 31 68 d2 f4 9a 0b 90 bd 2b ee 52 e0 ae c1 62 21 4b b4 ad 8c 5e 95 e4 79 44 f5 ff de ef 23 45 89 a4 28 db bb 69 ae e8 1a 6b 58 7c 7c 24 bf f7 83 9a af e3 b4 c8 cb da 3a 96 c9 bb 43 5d 17 95 7f 77 b7 cb b3 ba b2 f7 79 be 4f 68 50 c4 95 1d e6 e9 5d 58 55 ee 3f ef 82 34 4e 5e 1f be cf 6a 5a fa cf fb 43 fd f5 c2 71 36 4b c7 f9 a7 28 ae 8a 24 78 7d a8 9e 83 62 b2 b1 c3 a0 8c 9a 6d 10 3e ee cb fc 98 45 24 cc 93 bc f4 df ee 76 bb cd 36 2f 23 5a 92 32 88 e2 63 e5 7b c5 0b b4 bc 90 ea 10 44 f9 b3 ef 58 b3 e2 c5 9a c3 ff 72 bf 0d de 39 53 fc d8 33 77 32 e5 3d ae d6 e3 2e 26 7c 7a fc 4b 9c ed fd 16 36 b4 6c 76 49 1e d4 7e 42 77 f5 26 0d ca 7d 9c 41 6b 5d e7 a9 ef d2 54 b4 Data Ascii: <6zb:=S#1h+Rb!K^yD#E(ikX\|\|$:C]wyOhP]XU?4N^jZCq6K($x}bm>E$v6/#Z2c{DXr9S3w2=.&\|zK6lvI~Bw&}Ak]T

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:10 UTC	579	OUT	GET /ofb7tyq.css HTTP/1.1 Host: use.typekit.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:10 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/css;charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains; Cache-Control: private, max-age=600, stale-while-revalidate=604800 Timing-Allow-Origin: * Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Mon, 17 Mar 2025 16:47:10 GMT Content-Length: 6849 Connection: close Akamai-GRN: 0.5c641002.1742230030.f30eccf
2025-03-17 16:47:10 UTC	6849	IN	Data Raw: 2f 2a 0a 20 2a 20 54 68 65 20 54 79 70 65 6b 69 74 20 73 65 72 76 69 63 65 20 75 73 65 64 20 74 6f 20 64 65 6c 69 76 65 72 20 74 68 69 73 20 66 6f 6e 74 20 6f 72 20 66 6f 6e 74 73 20 66 6f 72 20 75 73 65 20 6f 6e 20 77 65 62 73 69 74 65 73 0a 20 2a 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 41 64 6f 62 65 20 61 6e 64 20 69 73 20 73 75 62 6a 65 63 74 20 74 6f 20 74 68 65 73 65 20 54 65 72 6d 73 20 6f 66 20 55 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 61 64 6f 62 65 2e 63 6f 6d 2f 70 72 6f 64 75 63 74 73 2f 65 75 6c 61 73 2f 74 6f 75 5f 74 79 70 65 6b 69 74 2e 20 46 6f 72 20 66 6f 6e 74 20 6c 69 63 65 6e 73 65 0a 20 2a 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 73 65 65 20 74 68 65 20 6c 69 73 74 20 62 65 6c 6f 77 2e 0a 20 2a 0a 20 2a 20 66 69 Data Ascii: /* * The Typekit service used to deliver this font or fonts for use on websites * is provided by Adobe and is subject to these Terms of Use * http://www.adobe.com/products/eulas/tou_typekit. For font license * information, see the list below. * * fi

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:11 UTC	582	OUT	GET /static/js/main.24c9e005.js HTTP/1.1 Host: pay.felloh.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:11 UTC	498	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 309016 Connection: close Date: Mon, 17 Mar 2025 16:47:12 GMT Cache-Control: max-age=31536000,public Content-Encoding: gzip Last-Modified: Thu, 23 Jan 2025 00:23:34 GMT ETag: "6492109e8548faca694d664ef4bbe4bf" Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 44c11b9e7f9c69a8ff1ceeb4b7d9e50c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P11 X-Amz-Cf-Id: hX5qx5WXvBP7hG2PO48PNNJUfgsme2oq2pj-lpyVEWZ9TNuL4qzxkA==
2025-03-17 16:47:11 UTC	8009	IN	Data Raw: 1f 8b 08 00 00 00 00 00 02 03 ec 3d 6b 73 e3 c6 91 df ef 57 40 a8 9c 02 c4 10 c4 87 5e 04 0d 33 5a 2d 6d eb b2 bb d2 49 da 38 2e 45 a7 82 c0 a1 08 2f 08 30 c0 50 bb 0a c9 ff 7e dd f3 00 06 0f 8a 8f dd b5 e3 2a 57 5c 2b 70 30 d3 d3 d3 d3 ef 9e 41 f6 ff b2 a3 7d 1f 27 5a 18 f8 24 4a 89 16 44 c3 38 19 7b 34 88 23 6d 12 12 0f 9a 52 42 b4 b1 17 44 76 eb c0 ef 90 46 e3 d0 fe 25 b5 df 9c 9f f5 df 5d f7 6d fa 89 6a 7f d9 ff af 9d e1 34 f2 71 90 61 ce 9e bc 44 23 ee ec b8 d5 3a 71 b2 66 62 ce 88 4d 3e 4d e2 84 a6 6e de 6a 51 73 66 44 d3 30 74 5d 3a 9f d3 ef 88 1d 92 e8 91 8e cc dd 5d 83 ba d9 af 2e 20 65 20 dc c8 6d 58 89 1b 91 8f da 69 92 78 cf 06 35 bb d1 b7 b4 1b 7d f3 8d 99 dc 46 77 2e 81 7f ba 09 a1 d3 24 d2 92 85 95 4d 69 df df 93 f4 6d 3c 98 86 c4 dd 69 28 Data Ascii: =ksW@^3Z-mI8.E/0P~*W\+p0A}'Z$JD8{4#mRBDvF%]mj4qaD#:qfbM>MnjQsfD0t]:]. e mXix5}Fw.$Mim<i(
2025-03-17 16:47:11 UTC	4879	IN	Data Raw: fc 11 e2 ed f8 4a e5 6e e8 f8 44 37 c0 cb fa 59 d7 71 7c 51 3c bd a3 38 5e 93 e9 c5 d3 7e da bd db 5d b1 5f d5 53 cf a5 5d aa 5f d5 2d 57 1f 97 82 c2 89 e5 c9 a8 19 78 f2 89 03 4f fa 49 77 35 75 f5 35 ba fd e5 84 19 c1 1f f2 c9 d6 3a fc 46 c8 03 e1 f1 1f 06 79 ec af 8d 3c 7e 7f c6 b5 14 32 ec 0f c3 c3 7e b9 9f f0 f2 c8 71 03 1f 74 8e 7e 07 9e e2 4d 39 90 c4 a7 f3 15 a5 2a 74 de 02 77 23 f2 16 9d bd bd cf e5 2d aa 9b d2 dc b8 df 9e b7 10 11 e5 ca cc 05 23 73 16 92 cd 98 ca 3d 3b fa 3a 6c 46 6a b0 19 71 99 cd 88 57 b1 19 8b 3b fd 16 d4 32 1a f1 4a 46 63 71 b7 4d f3 7a ac 86 42 59 b1 22 e6 c8 b7 d7 ea 10 50 96 58 01 3b a5 60 01 58 07 34 e6 53 34 25 2b f2 4a 2c c8 6b b8 0a 79 0d ab c8 6b 58 83 bc a6 df 9a 67 92 1b 72 04 f0 be dd de fd fd c0 c6 97 c0 0b 53 08 Data Ascii: JnD7Yq\|Q<8^~]_S]_-WxOIw5u5:Fy<~2~qt~M9*tw#-#s=;:lFjqW;2JFcqMzBY"PX;`X4S4%+J,kykXgrS
2025-03-17 16:47:11 UTC	1432	IN	Data Raw: 55 0a 0b fe 68 1d 8c 6f 9e 13 68 89 9f 13 e4 47 f9 39 81 c6 32 a0 a2 30 06 b9 74 85 b3 58 e1 52 6d c6 28 50 41 40 90 b3 39 41 43 cc 90 a0 d0 51 af 46 95 dd dd 53 41 42 d1 d9 29 8c 8b 3a 6c 4c 80 90 a6 59 2f 6e 04 26 9a 50 dc b9 35 aa eb d9 d9 c9 f1 cb b7 6f fe 7a f6 e4 f8 d1 bb 1f ce ce 6e 6f cb 29 40 6a 0d 9b 1f 2e 9a 57 21 d6 f1 38 4c 92 b4 68 08 cf 9e 8d 58 b5 d9 50 f2 2a bc fe 72 1a e3 2c 9d 91 51 3d 17 62 34 7e 5c 9c 3b 08 1e a1 f3 da 31 2c c2 ac d0 5c ed dc ed 90 ed 0c 49 7e d8 57 51 82 74 f4 8b a8 98 a4 23 d7 52 8f b1 43 d0 0b 50 f4 23 f3 75 79 17 28 b6 d6 6f 54 e0 95 31 19 8f 94 f2 e5 2e ab 36 37 f5 37 5c 75 79 01 cf cc fa 93 11 6f 0b 4f 3f 23 cb 54 da 3b 1e ce 5a 76 4f 7d aa ed 9a e5 4c 14 01 63 2c e8 58 70 2c 8c 39 64 c3 28 be 69 f9 e3 e6 9b 3f Data Ascii: UhohG920tXRm(PA@9ACQFSAB):lLY/n&P5ozno)@j.W!8LhXP*r,Q=b4~\;1,\I~WQt#RCP#uy(oT1.677\uyoO?#T;ZvO}Lc,Xp,9d(i?
2025-03-17 16:47:11 UTC	16384	IN	Data Raw: 13 5c 9a df 75 a7 b7 3c bb e6 01 1d 4e a3 f0 4e 5a cc 4a 76 af a4 a9 4d f2 bb 4a 61 b3 e1 73 17 f1 76 34 62 7c d4 67 c2 f8 50 1a ae f1 8d a0 b5 99 62 cb b6 02 8e 59 99 8b 4f bf f4 73 12 66 d5 ae 81 a6 7e d1 6d b7 5a 24 ff c1 5b 36 1d 9a b1 8b 65 b9 e7 d4 15 1b f1 b0 74 05 a7 87 94 b0 2d 91 16 a7 25 13 2c 99 91 c7 f3 4f d3 81 d7 cc a7 f1 30 72 b7 93 4f a4 df 9f 87 79 b1 62 e4 f5 bb e7 b4 92 62 53 52 c0 2d a9 dd 4f 7e d6 ee 5c 67 24 b0 7e 0f e5 f2 de 89 fb b5 9d 60 e7 b2 60 62 54 75 77 f6 5a ab ce 1c f9 e7 d5 51 dd 9c 28 b7 7b 9b d6 5c dc 7f 79 54 48 94 d4 aa 93 5f 42 3b 1a 70 55 a8 27 6a ae c9 00 70 68 ec 69 80 c6 56 3f c1 79 bd fa b5 b8 2c 86 1e 3c 0d 4e d9 ea 2e 61 cd 88 a0 78 7d dd 0c c6 b3 5c 5e 19 8d d8 ea 97 48 43 6f e3 53 f0 8e ca 2d db 13 08 26 6a Data Ascii: \u<NNZJvMJasv4b\|gPbYOsf~mZ$[6et-%,O0rOybbSR-O~\g$~``bTuwZQ({\yTH_B;pU'jphiV?y,<N.ax}\^HCoS-&j
2025-03-17 16:47:11 UTC	3664	IN	Data Raw: ef b7 1b 03 26 b2 37 0b 6b b1 14 78 26 f7 fd d5 ed 77 9e 19 54 41 bf 20 30 7b c4 3c 09 0a 1c 37 b2 96 d6 f7 69 a9 2c 1a c7 fb c6 de 4a 94 cc ce cc bd 95 48 7f 8b dd c4 00 2f 85 c5 3c 07 a8 80 c3 c3 b6 69 35 25 dc bb eb 21 60 2d 48 f7 66 59 62 43 4d a5 66 e5 f1 14 5d 5a c0 6e 2d ee 57 88 94 42 ec 5a cd 6b 1c 86 6a 57 11 0c 62 49 fa f4 cc eb e9 18 48 5d c5 a3 c4 5e c4 ee 0d 12 75 ab 66 02 06 04 f8 e4 6f 98 df 6f f2 9b b4 54 97 8e 40 61 e4 fc 58 4d 18 dd 51 54 a5 11 02 b1 47 b5 48 63 a4 15 0a 10 92 ff cf 91 8b 4f 3c 1e de 2b f1 73 e4 85 c9 bd 2e 6f 2b e7 bd 16 83 30 dc aa a9 b8 b4 0c 18 35 f4 4b c7 be 9b ca b5 4c 75 65 69 61 ae 09 1d 74 93 c0 e6 0d 40 de d9 9e 0e 3c 8f 1c 8b 48 b3 75 8f 79 01 69 af ab 89 dc 39 6a b5 51 4c 74 33 44 af 67 74 81 ff b1 40 24 90 Data Ascii: &7kx&wTA 0{<7i,JH/<i5%!`-HfYbCMf]Zn-WBZkjWbIH]^ufooT@aXMQTGHcO<+s.o+05KLueiat@<Huyi9jQLt3Dgt@$
2025-03-17 16:47:11 UTC	7160	IN	Data Raw: e4 ce 73 f8 e1 6d 86 1a 16 05 9a 65 97 e6 d9 f9 e5 d9 cb 27 af 7e 71 7c 02 36 94 94 32 df ed 62 ae 53 e9 dc fd 33 e7 1c 75 01 b8 fd ca cd 59 2e bb d3 a5 40 d3 12 12 a6 64 44 f7 a9 0b 93 c3 a6 5e 78 bf 2d e0 a1 de ff 14 17 12 ea dc 5d b8 04 2a d4 24 48 a3 2a 56 59 cf e6 8b 67 e7 3c 05 40 1f 26 b7 4c 79 e8 96 d1 ee 9c aa 35 d1 89 a1 78 36 94 44 bf 79 a9 06 db 0c 70 37 22 01 72 39 75 71 11 65 ce 00 dd e5 54 6e da 60 46 d1 b8 39 26 c7 e4 bd 9c b0 15 79 1f 27 4b 50 65 3b 27 2a 0f a1 f2 21 54 5e 84 17 39 39 c8 2a b2 10 aa 0e ef 0f 45 d5 21 56 2d b2 2f 82 e1 69 38 40 0d c1 d3 05 0b 31 31 42 b9 cc 18 6a 99 1b b2 99 29 4c cc fd b9 a8 63 2c ba 37 09 e6 a7 e3 81 3f 0b a6 a7 13 ec de 8c f4 d0 4e 27 5a df 06 c1 cc e8 69 04 2d 05 23 b4 d2 f1 3f 0f 53 7c 43 d0 ae df fb Data Ascii: sme'~q\|62bS3uY.@dD^x-]$HVYg<@&Ly5x6Dyp7"r9uqeTn`F9&y'KPe;'!T^99E!V-/i8@11Bj)Lc,7?N'Zi-#?S\|C
2025-03-17 16:47:11 UTC	2864	IN	Data Raw: 3d 7d 7b cb ed d0 f3 8c 64 6e 58 60 14 d5 e2 5f 41 e7 6d 8d d1 15 27 5f 0f e1 26 0f 25 62 46 2d 91 f9 2a e5 c8 b6 6e 21 64 f2 b4 b0 f0 7a c5 28 78 12 6a 28 78 24 5d 5d 6f 9f 41 bf c6 08 16 27 49 8b 06 2a c2 37 1b 44 05 41 3d 61 d1 b8 4e 17 8d 49 78 19 35 c2 06 0c 03 73 31 2a a1 a1 d9 e1 02 98 a1 d5 a5 86 35 ff fe e6 04 32 cf c3 5a 84 37 4f 85 1f 8b 61 4f da e6 e9 0b d5 ae 7a fa 3c 6b fb 5e 05 af ab 18 a1 ea 5a 59 b7 b7 49 9d 87 dd 58 19 a1 a6 9b 9b 69 af 74 8a 64 38 f3 45 b3 1a 62 c3 e3 c3 f7 eb 0a 0d 4b 90 f6 a6 e2 b9 70 63 c3 ea bb 70 63 23 5e ae a8 77 6a d6 5b 07 13 44 90 3d f3 e0 01 03 90 34 71 9d e0 d0 31 8b 22 7d 01 89 fb b4 c4 a3 b2 d5 14 61 18 0c 2a e0 1a a7 73 55 08 bd f2 90 ee 0e 3e 5e 41 4e b5 5d d1 23 52 68 dd 89 c9 05 c6 f8 da 0e e8 ea a7 88 Data Ascii: =}{dnX`_Am'_&%bF-n!dz(xj(x$]]oA'I7DA=aNIx5s152Z7OaOz<k^ZYIXitd8EbKpcpc#^wj[D=4q1"}asU>^AN]#Rh
2025-03-17 16:47:11 UTC	2864	IN	Data Raw: 8f f6 af a8 90 59 6a 19 25 c9 6a ab 38 4d b6 e2 c1 df 00 ca 5c c0 32 bb f0 03 0c bb 6c 12 b5 a8 b7 78 1a 95 75 63 4f 51 fd 74 8b 08 ec 5b 0b bd 40 a4 a3 b2 26 50 b9 3f db 46 eb f7 5b ba 3a a2 46 84 96 bb d0 f2 bc 6d a3 0b 2d 54 80 5f 31 3f d2 2c ad 3c 1f 38 de 04 ad d4 64 dd 31 db 14 75 93 83 99 cb 53 23 a7 01 77 94 31 11 09 4c 04 82 6c 37 aa 40 c1 bd 83 76 fd 31 41 dc e0 31 f1 c5 bd 56 1b 7b 0f 4f f8 10 c2 03 94 64 ae 63 f1 a4 79 ba fb 1e a5 c0 85 1b 94 99 ed a2 9f 0d 4c 21 a9 df e3 34 43 4a 86 14 83 83 c2 17 18 05 a5 6d cc 59 8a 96 f2 38 5d 24 00 f5 15 6e 61 24 97 ca 86 69 e8 48 18 d5 7f 99 34 60 a8 4e 47 6f 81 1a b7 4f 10 25 55 41 1b 4e 4e 46 b6 10 7a 3d c2 ef b8 ad c5 a5 bf c0 e8 d0 61 f6 a1 6a 5a 17 dd 6f 71 1d 09 ad e3 f7 91 71 2b ec 5f aa 77 f5 d1 Data Ascii: Yj%j8M\2lxucOQt[@&P?F[:Fm-T_1?,<8d1uS#w1Ll7@v1A1V{OdcyL!4CJmY8]$na$iH4`NGoO%UANNFz=ajZoqq+_w
2025-03-17 16:47:11 UTC	16384	IN	Data Raw: c8 1f db 14 b0 86 1e 3b 18 ef a0 d5 9b de cf 7b 53 e4 23 b9 97 7c d2 06 18 fa 0b a5 29 11 2f fd ca 50 4b 13 c2 a3 46 17 2c 50 74 23 6b 3e ef 4a 2f d5 26 f3 71 ba f7 bd 1b 01 bb 08 9d ea f1 bc 2f ee cc db 96 79 ff f7 ce bc 1d 99 f7 c7 3b f3 ee 0e 64 f8 67 96 b5 ac fa 80 4a 40 35 2a 2e 37 17 86 f1 36 f7 c4 7f bf 5d 5d 72 d2 bc a0 d5 f5 94 2a 75 d1 7c fe ea 07 de 1d a6 7d f3 71 5e 69 a9 17 dd 6f f5 bc 68 0b 99 7b 26 4d 89 1e c0 f3 01 a4 6d 53 9a ac ec f8 2f af b5 ca e4 5b 57 b1 c1 50 cc f3 65 9b a5 0f 4b e3 da 4a af 2e 19 04 ed fb f7 93 1e 13 55 c3 f7 fb d8 be 25 97 f1 ba bd 37 f8 9b 99 b0 5f 4e 38 28 27 1c 0d 7a 4a 1e 8e 83 63 8d a8 69 32 1b 44 15 6e 43 f5 0b 15 11 eb 74 bf 48 09 f1 e5 bb 17 8f 8e df a0 16 18 be 3d 7c fe fa c7 87 98 d6 ed f8 a6 8e 62 77 8f Data Ascii: ;{S#\|)/PKF,Pt#k>J/&q/y;dgJ@5.76]]ru\|}q^ioh{&MmS/[WPeKJ.U%7_N8('zJci2DnCtH=\|bw
2025-03-17 16:47:11 UTC	16384	IN	Data Raw: 89 7e 86 91 68 d7 94 5f a0 36 c8 6a ab 1c b3 b9 d7 f0 9c 6d e2 ae 1b 46 4d be 4e ac c9 d7 09 35 f9 2a 6a b2 a7 6a b2 a7 6b f2 15 66 c3 cb 35 f9 ca 6b b2 2f 6b 02 4b 63 33 f5 3f e8 a9 a3 dc 7a f8 f0 50 9c 6f 7e c9 23 5c 8b 19 82 ec 33 b0 2a 52 1a 1b a3 6b 53 84 10 05 56 7a d4 97 53 0d 2f c5 94 ca ef 51 06 ce 8b e1 1f 3b 55 72 5d 94 2b 47 83 20 7d 94 eb f6 0d ac db 81 52 f3 7b 4f 45 d5 a5 67 9b 01 14 25 5e 0a 38 86 19 1e 55 17 d8 ff 70 43 1e 9e 2f 14 49 cf 7f bb 48 d1 96 17 ea 79 64 e4 28 15 6b 60 d6 30 cb 9f 4b 17 fd 42 7d 8f 8c 1c 7f 52 f4 98 9d d9 3b e2 9b 5f ed 7b e8 03 c7 c5 0c 46 f3 c5 0e 6e 96 8d 49 2c f0 75 77 15 f2 88 14 02 63 e5 71 95 9d c5 85 99 84 ab c8 0b 2b 3e b6 d6 31 9c 0f 61 e7 99 8e 2c d3 0b d8 e9 d2 39 be 07 93 8b 66 ea 51 8a 6d 56 8d e7 Data Ascii: ~h_6jmFMN5jjkf5k/kKc3?zPo~#\3RkSVzS/Q;Ur]+G }R{OEg%^8UpC/IHyd(k`0KB}R;_{FnI,uwcq+>1a,9fQmV

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:11 UTC	683	OUT	GET /p.css?s=1&k=ofb7tyq&ht=tk&f=24561.24562.24563.24567.24570.24571.28747.28752.28755.28762&a=44397402&app=typekit&e=css HTTP/1.1 Host: p.typekit.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Referer: https://use.typekit.net/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:11 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/css Content-Length: 5 Last-Modified: Sun, 01 Dec 2024 12:44:58 GMT ETag: "674c5a4a-5" Cache-Control: public, max-age=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Accept-Ranges: bytes Date: Mon, 17 Mar 2025 16:47:11 GMT Connection: close
2025-03-17 16:47:11 UTC	5	IN	Data Raw: 2f 2a 2a 2f 0a Data Ascii: /**/

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:12 UTC	607	OUT	POST /api/event HTTP/1.1 Host: metrics.felloh.com Connection: keep-alive Content-Length: 112 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain sec-ch-ua-mobile: ?0 Accept: / Origin: https://pay.felloh.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:12 UTC	112	OUT	Data Raw: 7b 22 6e 22 3a 22 70 61 67 65 76 69 65 77 22 2c 22 75 22 3a 22 68 74 74 70 73 3a 2f 2f 70 61 79 2e 66 65 6c 6c 6f 68 2e 63 6f 6d 2f 38 35 64 38 34 35 64 33 2d 30 32 36 39 2d 34 31 37 37 2d 61 35 66 39 2d 36 61 34 35 34 36 39 31 38 30 65 61 22 2c 22 64 22 3a 22 70 61 79 2e 66 65 6c 6c 6f 68 2e 63 6f 6d 22 2c 22 72 22 3a 6e 75 6c 6c 7d Data Ascii: {"n":"pageview","u":"https://pay.felloh.com/85d845d3-0269-4177-a5f9-6a45469180ea","d":"pay.felloh.com","r":null}
2025-03-17 16:47:12 UTC	365	IN	HTTP/1.1 202 Accepted Server: nginx/1.18.0 (Ubuntu) Date: Mon, 17 Mar 2025 16:47:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: cache-control: max-age=0, private, must-revalidate x-request-id: GC2k--WUTlFhnAwAoR0B
2025-03-17 16:47:12 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:12 UTC	567	OUT	GET /logger-1.min.js HTTP/1.1 Host: cdn.lr-in.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:12 UTC	1227	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:47:12 GMT Content-Type: text/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * Cache-Control: public, max-age=14400 cross-origin-resource-policy: cross-origin etag: W/"90b87a995d38ee230559fa452f89cb82340b5fcc164f1e6b9d9fdbb97f83299d-br" last-modified: Mon, 17 Mar 2025 14:00:52 GMT strict-transport-security: max-age=31556926 x-served-by: cache-lga21927-LGA x-cache: HIT x-cache-hits: 1 x-timer: S1742220141.272151,VS0,VE1 vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443"; ma=86400 CF-Cache-Status: HIT Age: 259 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W7tXZq78jySIP7i9FTgkn2sF6Vr55WWA%2F%2F52khiVfXNKwa8hlem3Mt3ZSzejbwaoXq0GLdM5X3sh8FPTZD7%2BH3nnB0mGQZRZnywtPqQX2y7%2B%2Bt60YSt4SUMpXdCaYFuk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921df8884d3b43b3-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1640&rtt_var=655&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=1139&delivery_rate=1622222&cwnd=209&unsent_bytes=0&cid=eb0ac2f297b4e6b6&ts=173&x=0"
2025-03-17 16:47:12 UTC	142	IN	Data Raw: 37 62 36 35 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 31 32 37 30 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 36 34 38 33 36 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 65 6e 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 7b65!function(){var e={12706:function(e,t,r){"use strict";var n=r(64836);Object.defineProperty(t,"__esModule",{value:!0}),t.encode=function(
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 65 29 7b 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 70 28 65 29 29 7d 2c 74 2e 65 6e 63 6f 64 65 41 73 54 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 70 28 65 29 7d 2c 74 2e 64 65 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 65 3c 30 29 72 65 74 75 72 6e 20 6e 28 65 29 3b 76 61 72 20 74 3d 6e 65 77 20 41 72 72 61 79 28 65 2e 6c 65 6e 67 74 68 29 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 72 65 74 75 72 6e 20 65 20 69 6e 20 74 3f 74 5b 65 5d 3a 74 5b 65 5d 3d 6e 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 69 66 28 74 3c 30 29 7b 69 66 28 74 3d 3d 3d 69 29 72 65 74 Data Ascii: e){return JSON.stringify(p(e))},t.encodeAsTable=function(e){return p(e)},t.decode=function(e){return function(e){if("number"==typeof e&&e<0)return n(e);var t=new Array(e.length);function r(e){return e in t?t[e]:t[e]=n(e)}function n(t){if(t<0){if(t===i)ret
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 73 77 69 74 63 68 28 28 30 2c 6f 2e 64 65 66 61 75 6c 74 29 28 65 29 29 7b 63 61 73 65 22 75 6e 64 65 66 69 6e 65 64 22 3a 72 65 74 75 72 6e 20 69 3b 63 61 73 65 22 6e 75 6d 62 65 72 22 3a 69 66 28 69 73 4e 61 4e 28 65 29 29 72 65 74 75 72 6e 20 73 3b 69 66 28 21 69 73 46 69 6e 69 74 65 28 65 29 29 72 65 74 75 72 6e 20 65 3c 30 3f 63 3a 75 7d 76 61 72 20 6e 3b 72 65 74 75 72 6e 20 72 3f 76 6f 69 64 20 30 3d 3d 3d 28 6e 3d 72 2e 67 65 74 28 65 29 29 26 26 28 6e 3d 74 2e 70 75 73 68 28 65 29 2d 31 2c 72 2e 73 65 74 28 65 2c 6e 29 29 3a 28 6e 3d 74 2e 69 6e 64 65 78 4f 66 28 65 29 29 3c 30 26 26 28 6e 3d 74 2e 70 75 73 68 28 65 29 2d 31 29 2c 6e 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 76 61 72 20 74 3d 65 3b 69 66 28 65 26 26 22 6f 62 6a 65 63 74 22 3d Data Ascii: switch((0,o.default)(e)){case"undefined":return i;case"number":if(isNaN(e))return s;if(!isFinite(e))return e<0?c:u}var n;return r?void 0===(n=r.get(e))&&(n=t.push(e)-1,r.set(e,n)):(n=t.indexOf(e))<0&&(n=t.push(e)-1),n}function f(e){var t=e;if(e&&"object"=
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 6e 65 77 20 52 65 67 45 78 70 28 65 5b 30 5d 2c 65 5b 31 5d 29 7d 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 65 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 2e 66 72 6f 6d 26 26 66 28 22 53 65 74 22 2c 7b 64 65 63 6f 6e 73 74 72 75 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 5b 6f 62 6a 65 63 74 20 53 65 74 5d 22 3d 3d 3d 64 2e 63 61 6c 6c 28 65 29 29 72 65 74 75 72 6e 20 41 72 72 61 79 2e 66 72 6f 6d 28 65 29 7d 2c 72 65 63 6f 6e 73 74 72 75 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 6e 65 77 20 53 65 74 3b 65 2e 66 6f 72 45 61 63 68 28 74 68 69 73 2e 61 64 64 2c 74 68 69 73 29 7d Data Ascii: nction(e){return e&&new RegExp(e[0],e[1])}}),"function"==typeof Set&&"function"==typeof Array.from&&f("Set",{deconstruct:function(e){if("[object Set]"===d.call(e))return Array.from(e)},reconstruct:function(e){if(!e)return new Set;e.forEach(this.add,this)}
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 7b 7d 29 2e 61 73 73 65 74 43 61 70 74 75 72 65 2c 6f 3d 76 6f 69 64 20 30 3d 3d 3d 6e 3f 7b 7d 3a 6e 3b 28 30 2c 61 2e 64 65 66 61 75 6c 74 29 28 74 68 69 73 2c 65 29 2c 74 68 69 73 2e 63 61 70 74 75 72 65 50 65 72 66 6f 72 6d 61 6e 63 65 45 6e 74 72 79 3d 28 30 2c 75 2e 70 72 6f 74 65 63 74 46 75 6e 63 29 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 69 66 28 22 6e 61 76 69 67 61 74 69 6f 6e 22 3d 3d 3d 65 2e 65 6e 74 72 79 54 79 70 65 29 72 2e 5f 61 64 64 52 65 73 6f 75 72 63 65 45 76 65 6e 74 28 Data Ascii: function e(t){var r=this,n=(arguments.length>1&&void 0!==arguments[1]?arguments[1]:{}).assetCapture,o=void 0===n?{}:n;(0,a.default)(this,e),this.capturePerformanceEntry=(0,u.protectFunc)((function(e){if(e)if("navigation"===e.entryType)r._addResourceEvent(
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 3a 22 29 29 7b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 6f 2e 68 72 65 66 3d 6e 3b 76 61 72 20 69 2c 61 3d 7b 69 6e 69 74 69 61 74 6f 72 54 79 70 65 3a 74 2c 6e 61 6d 65 3a 6f 2e 68 72 65 66 2c 73 74 61 72 74 54 69 6d 65 3a 44 61 74 65 2e 6e 6f 77 28 29 7d 2c 73 3d 28 72 2e 5f 6c 6f 67 67 65 72 2e 67 65 74 43 6f 6e 66 69 67 28 22 6c 72 2e 6e 65 74 77 6f 72 6b 2e 50 65 72 66 52 65 73 6f 75 72 63 65 45 76 65 6e 74 22 29 7c 7c 7b 7d 29 2e 72 65 71 75 65 73 74 53 61 6e 69 74 69 7a 65 72 2c 63 3d 76 6f 69 64 20 30 3d 3d 3d 73 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3a 73 3b 74 72 79 7b 69 3d 63 28 6c 28 6c 28 7b 7d 2c 61 29 2c 7b 7d 2c 7b 75 72 6c 3a 61 2e 6e 61 6d 65 2c 68 Data Ascii: :")){var o=document.createElement("a");o.href=n;var i,a={initiatorType:t,name:o.href,startTime:Date.now()},s=(r._logger.getConfig("lr.network.PerfResourceEvent")\|\|{}).requestSanitizer,c=void 0===s?function(e){return e}:s;try{i=c(l(l({},a),{},{url:a.name,h
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 74 50 65 72 66 6f 72 6d 61 6e 63 65 53 74 61 74 75 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 2e 5f 69 73 50 65 72 66 6f 72 6d 61 6e 63 65 45 6e 61 62 6c 65 64 3d 65 2c 74 68 69 73 2e 5f 62 72 6f 77 73 65 72 4c 6f 61 64 54 69 6d 65 3d 74 7d 7d 2c 7b 6b 65 79 3a 22 73 65 74 44 6f 6d 53 74 61 74 75 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 5f 69 73 44 6f 6d 45 6e 61 62 6c 65 64 3d 21 31 3d 3d 3d 74 68 69 73 2e 5f 69 73 44 69 73 61 62 6c 65 64 26 26 21 30 3d 3d 3d 74 68 69 73 2e 5f 69 73 50 65 72 66 6f 72 6d 61 6e 63 65 45 6e 61 62 6c 65 64 26 26 65 2c 74 68 69 73 2e 5f 69 73 44 6f 6d 45 6e 61 62 6c 65 64 3f 74 68 69 73 2e 5f 73 63 68 65 64 75 6c 65 43 6c 6f 73 69 6e 67 4c 6f 6f 70 28 Data Ascii: tPerformanceStatus",value:function(e,t){this._isPerformanceEnabled=e,this._browserLoadTime=t}},{key:"setDomStatus",value:function(e){this._isDomEnabled=!1===this._isDisabled&&!0===this._isPerformanceEnabled&&e,this._isDomEnabled?this._scheduleClosingLoop(
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 75 65 73 74 73 3d 74 7d 7d 2c 7b 6b 65 79 3a 22 5f 61 64 64 52 65 73 6f 75 72 63 65 45 76 65 6e 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 32 30 30 2c 6e 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 3d 3d 3d 65 2e 65 6e 74 72 79 54 79 70 65 3f 22 6e 61 76 69 67 61 74 69 6f 6e 22 3a 65 2e 69 6e 69 74 69 61 74 6f 72 54 79 70 65 3b 74 68 69 73 2e 5f 6c 6f 67 67 65 72 2e 61 64 64 45 76 65 6e 74 28 22 6c 72 2e 6e 65 74 77 6f 72 6b 2e 50 65 72 66 52 65 73 6f 75 72 63 65 45 76 65 6e 74 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b Data Ascii: uests=t}},{key:"_addResourceEvent",value:function(e){var t=this,r=arguments.length>1&&void 0!==arguments[1]?arguments[1]:200,n="navigation"===e.entryType?"navigation":e.initiatorType;this._logger.addEvent("lr.network.PerfResourceEvent",(function(){return{
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 3d 5b 5d 2c 74 68 69 73 2e 5f 63 6c 6f 73 69 6e 67 4c 6f 6f 70 54 69 6d 65 72 26 26 28 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 5f 63 6c 6f 73 69 6e 67 4c 6f 6f 70 54 69 6d 65 72 29 2c 74 68 69 73 2e 5f 63 6c 6f 73 69 6e 67 4c 6f 6f 70 54 69 6d 65 72 3d 6e 75 6c 6c 29 7d 7d 5d 29 2c 65 7d 28 29 3b 74 2e 64 65 66 61 75 6c 74 3d 64 7d 2c 36 36 30 34 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 55 54 4d 5f 50 41 52 41 4d 5f 4b 45 59 3d 74 2e 55 54 4d 5f 50 41 52 41 4d 45 54 45 52 5f 54 4f 5f 45 56 45 4e 54 5f 4b 45 59 5f 4d 41 50 50 49 4e 47 3d 76 6f 69 Data Ascii: =[],this._closingLoopTimer&&(clearTimeout(this._closingLoopTimer),this._closingLoopTimer=null)}}]),e}();t.default=d},66044:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.UTM_PARAM_KEY=t.UTM_PARAMETER_TO_EVENT_KEY_MAPPING=voi
2025-03-17 16:47:12 UTC	1369	IN	Data Raw: 6e 28 72 28 38 31 39 32 36 29 29 2c 63 3d 6e 28 72 28 36 33 35 36 29 29 2c 6c 3d 6e 28 72 28 35 38 35 37 35 29 29 2c 66 3d 6e 28 72 28 36 33 32 33 31 29 29 2c 64 3d 72 28 37 35 33 37 33 29 2c 70 3d 72 28 38 30 38 37 31 29 7d 2c 38 31 39 32 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 30 2c 6e 2e 61 64 64 4c 69 73 74 65 6e 65 72 29 28 22 63 6f 70 79 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 64 65 61 64 43 6c 69 63 6b 73 4d 6f 6e 69 74 6f 72 2e 72 65 73 65 74 28 29 7d 29 Data Ascii: n(r(81926)),c=n(r(6356)),l=n(r(58575)),f=n(r(63231)),d=r(75373),p=r(80871)},81926:function(e,t,r){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){return(0,n.addListener)("copy",(function(){e._deadClicksMonitor.reset()})

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:13 UTC	655	OUT	GET /payment/payment-link/85d845d3-0269-4177-a5f9-6a45469180ea?method=ONLINE HTTP/1.1 Host: payment.api.felloh.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: https://pay.felloh.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:13 UTC	547	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1082 Connection: close Date: Mon, 17 Mar 2025 16:47:13 GMT Access-Control-Allow-Credentials: true x-amzn-RequestId: edab3e2c-083f-418b-b091-825f35079b01 Access-Control-Allow-Origin: * x-amz-apigw-id: HlHCwErsLPEEfbg= X-Amzn-Trace-Id: Root=1-67d85211-17451e557fe66189729d52e0 X-Cache: Miss from cloudfront Via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P3 X-Amz-Cf-Id: g6GYIUrBK41yF05bO_cbGZxHOk33pIW--jfujzDaEjJGkjHU8Tjtfg==
2025-03-17 16:47:13 UTC	1082	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 22 38 35 64 38 34 35 64 33 2d 30 32 36 39 2d 34 31 37 37 2d 61 35 66 39 2d 36 61 34 35 34 36 39 31 38 30 65 61 22 2c 22 61 6d 6f 75 6e 74 22 3a 31 33 34 34 30 30 30 2c 22 63 75 72 72 65 6e 63 79 22 3a 22 55 53 58 22 2c 22 63 75 73 74 6f 6d 65 72 5f 6e 61 6d 65 22 3a 22 44 6f 72 69 73 20 4c 69 63 68 74 22 2c 22 63 75 73 74 6f 6d 65 72 22 3a 7b 22 69 64 22 3a 22 34 35 34 32 66 30 62 61 2d 38 65 31 61 2d 34 65 63 35 2d 61 36 30 32 2d 30 34 35 65 38 39 66 34 38 34 63 64 22 2c 22 63 75 73 74 6f 6d 65 72 5f 6e 61 6d 65 22 3a 22 44 6f 72 69 73 20 4c 69 63 68 74 22 2c 22 65 6d 61 69 6c 22 3a 22 64 6f 72 69 73 40 6c 69 63 68 74 77 65 62 2e 63 6f 6d 22 2c 22 61 64 64 72 65 73 73 5f 31 22 3a 6e 75 6c 6c 2c 22 61 64 64 72 65 Data Ascii: {"data":{"id":"85d845d3-0269-4177-a5f9-6a45469180ea","amount":1344000,"currency":"USX","customer_name":"Doris Licht","customer":{"id":"4542f0ba-8e1a-4ec5-a602-045e89f484cd","customer_name":"Doris Licht","email":"doris@lichtweb.com","address_1":null,"addre

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:13 UTC	582	OUT	GET / HTTP/1.1 Host: enums.api.felloh.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: https://pay.felloh.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:13 UTC	547	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2101 Connection: close Date: Mon, 17 Mar 2025 16:47:13 GMT Access-Control-Allow-Credentials: true x-amzn-RequestId: 933ac3cb-dbc8-4788-bf00-ba1e22b1a4cf Access-Control-Allow-Origin: * x-amz-apigw-id: HlHCwGAeLPEEAEg= X-Amzn-Trace-Id: Root=1-67d85211-4fee1dc460387db7267d5605 X-Cache: Miss from cloudfront Via: 1.1 e6d97713eb9b65f883e0f86b833878dc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA50-C1 X-Amz-Cf-Id: pphHLbqYsELcENQy3qq8zx4F_x44PnWFtlHnnszcswqUWYlWKYmn8w==
2025-03-17 16:47:13 UTC	2101	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 75 72 72 65 6e 63 79 22 3a 7b 22 55 53 58 22 3a 7b 22 6d 69 6e 6f 72 5f 75 6e 69 74 22 3a 22 55 53 58 22 2c 22 6d 61 6a 6f 72 5f 75 6e 69 74 22 3a 22 55 53 44 22 2c 22 64 69 76 69 73 69 6f 6e 5f 66 61 63 74 6f 72 22 3a 31 30 30 7d 2c 22 45 55 58 22 3a 7b 22 6d 69 6e 6f 72 5f 75 6e 69 74 22 3a 22 45 55 58 22 2c 22 6d 61 6a 6f 72 5f 75 6e 69 74 22 3a 22 45 55 52 22 2c 22 64 69 76 69 73 69 6f 6e 5f 66 61 63 74 6f 72 22 3a 31 30 30 7d 2c 22 47 42 58 22 3a 7b 22 6d 69 6e 6f 72 5f 75 6e 69 74 22 3a 22 47 42 58 22 2c 22 6d 61 6a 6f 72 5f 75 6e 69 74 22 3a 22 47 42 50 22 2c 22 64 69 76 69 73 69 6f 6e 5f 66 61 63 74 6f 72 22 3a 31 30 30 7d 7d 2c 22 6f 72 67 61 6e 69 73 61 74 69 6f 6e 22 3a 7b 22 66 65 61 74 75 72 65 22 3a 5b 22 75 Data Ascii: {"data":{"currency":{"USX":{"minor_unit":"USX","major_unit":"USD","division_factor":100},"EUX":{"minor_unit":"EUX","major_unit":"EUR","division_factor":100},"GBX":{"minor_unit":"GBX","major_unit":"GBP","division_factor":100}},"organisation":{"feature":["u

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:13 UTC	1001	OUT	POST /e/?ip=1&_=1742230031009&ver=1.82.3 HTTP/1.1 Host: analytics.felloh.com Connection: keep-alive Content-Length: 1255 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: / Origin: https://pay.felloh.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22anonymous%22%2C%22%24sesid%22%3A%5B1742230031008%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%7D
2025-03-17 16:47:13 UTC	1255	OUT	Data Raw: 64 61 74 61 3d 65 79 4a 31 64 57 6c 6b 49 6a 6f 69 4d 44 45 35 4e 57 45 31 4d 44 41 74 4f 47 45 35 5a 53 30 33 4e 47 52 68 4c 54 6c 69 59 32 55 74 59 6a 63 35 59 32 4d 35 4e 57 4d 30 4d 6a 67 33 49 69 77 69 5a 58 5a 6c 62 6e 51 69 4f 69 49 6b 63 47 46 6e 5a 58 5a 70 5a 58 63 69 4c 43 4a 77 63 6d 39 77 5a 58 4a 30 61 57 56 7a 49 6a 70 37 49 69 52 76 63 79 49 36 49 6c 64 70 62 6d 52 76 64 33 4d 69 4c 43 49 6b 62 33 4e 66 64 6d 56 79 63 32 6c 76 62 69 49 36 49 6a 45 77 4c 6a 41 69 4c 43 49 6b 59 6e 4a 76 64 33 4e 6c 63 69 49 36 49 6b 4e 6f 63 6d 39 74 5a 53 49 73 49 69 52 6b 5a 58 5a 70 59 32 56 66 64 48 6c 77 5a 53 49 36 49 6b 52 6c 63 32 74 30 62 33 41 69 4c 43 49 6b 59 33 56 79 63 6d 56 75 64 46 39 31 63 6d 77 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 33 Data Ascii: data=eyJ1dWlkIjoiMDE5NWE1MDAtOGE5ZS03NGRhLTliY2UtYjc5Y2M5NWM0Mjg3IiwiZXZlbnQiOiIkcGFnZXZpZXciLCJwcm9wZXJ0aWVzIjp7IiRvcyI6IldpbmRvd3MiLCIkb3NfdmVyc2lvbiI6IjEwLjAiLCIkYnJvd3NlciI6IkNocm9tZSIsIiRkZXZpY2VfdHlwZSI6IkRlc2t0b3AiLCIkY3VycmVudF91cmwiOiJodHRwczovL3
2025-03-17 16:47:13 UTC	811	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close X-Amz-Cf-Pop: FRA56-P5 Date: Mon, 17 Mar 2025 16:47:13 GMT server: envoy x-envoy-upstream-service-time: 12 access-control-allow-origin: https://pay.felloh.com access-control-allow-credentials: true access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: X-Requested-With,Content-Type vary: Origin, Accept-Encoding x-content-type-options: nosniff referrer-policy: same-origin cross-origin-opener-policy: same-origin Via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront), 1.1 756f5290bceb9f9b2ec963e0ab326968.cloudfront.net (CloudFront) X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: 3GIO0xxCpSYPlX2CKc36cXKbPRsai_Il6IPwD0NJOC_wflpnSttihA==
2025-03-17 16:47:13 UTC	18	IN	Data Raw: 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 20 31 7d 0d 0a Data Ascii: d{"status": 1}
2025-03-17 16:47:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://click.selectiveasia.com/l391pk/vx4w8gZP

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Windows Analysis Report
https://click.selectiveasia.com/l391pk/vx4w8gZP

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:13 UTC	1009	OUT	POST /decide/?v=3&ip=1&_=1742230031010&ver=1.82.3 HTTP/1.1 Host: analytics.felloh.com Connection: keep-alive Content-Length: 177 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: / Origin: https://pay.felloh.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22anonymous%22%2C%22%24sesid%22%3A%5B1742230031008%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%7D
2025-03-17 16:47:13 UTC	177	OUT	Data Raw: 64 61 74 61 3d 65 79 4a 30 62 32 74 6c 62 69 49 36 49 6e 42 6f 59 31 39 35 57 55 4a 56 51 58 56 31 4d 46 52 61 54 7a 4a 6d 55 58 6b 7a 63 6b 4e 54 4e 57 52 71 63 45 55 79 52 54 4e 30 56 6d 4a 6b 54 7a 6b 31 61 55 56 4d 65 58 52 6e 64 6c 51 34 49 69 77 69 5a 47 6c 7a 64 47 6c 75 59 33 52 66 61 57 51 69 4f 69 49 77 4d 54 6b 31 59 54 55 77 4d 43 30 34 59 54 6c 6a 4c 54 63 31 4d 6a 4d 74 4f 54 41 79 5a 53 31 6b 4e 44 6b 31 59 6a 64 69 5a 44 49 79 4d 7a 55 69 4c 43 4a 6e 63 6d 39 31 63 48 4d 69 4f 6e 74 39 66 51 25 33 44 25 33 44 Data Ascii: data=eyJ0b2tlbiI6InBoY195WUJVQXV1MFRaTzJmUXkzckNTNWRqcEUyRTN0VmJkTzk1aUVMeXRndlQ4IiwiZGlzdGluY3RfaWQiOiIwMTk1YTUwMC04YTljLTc1MjMtOTAyZS1kNDk1YjdiZDIyMzUiLCJncm91cHMiOnt9fQ%3D%3D
2025-03-17 16:47:13 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close X-Amz-Cf-Pop: FRA56-P5 Date: Mon, 17 Mar 2025 16:47:13 GMT server: envoy x-envoy-upstream-service-time: 7 access-control-allow-origin: https://pay.felloh.com access-control-allow-credentials: true access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: X-Requested-With,Content-Type vary: Origin, Accept-Encoding x-content-type-options: nosniff referrer-policy: same-origin cross-origin-opener-policy: same-origin Via: 1.1 91dc0292eef4e22508a3ae73fe64bbf4.cloudfront.net (CloudFront), 1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront) X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: _j0eiWbAzbi2C0pEEdnz5FdDlfNLSIIcMNSb-J28akLh7_Xq-yHoYA==
2025-03-17 16:47:13 UTC	974	IN	Data Raw: 33 63 37 0d 0a 7b 22 63 6f 6e 66 69 67 22 3a 20 7b 22 65 6e 61 62 6c 65 5f 63 6f 6c 6c 65 63 74 5f 65 76 65 72 79 74 68 69 6e 67 22 3a 20 74 72 75 65 7d 2c 20 22 74 6f 6f 6c 62 61 72 50 61 72 61 6d 73 22 3a 20 7b 7d 2c 20 22 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 73 75 70 70 6f 72 74 65 64 43 6f 6d 70 72 65 73 73 69 6f 6e 22 3a 20 5b 22 67 7a 69 70 22 2c 20 22 67 7a 69 70 2d 6a 73 22 5d 2c 20 22 66 65 61 74 75 72 65 46 6c 61 67 73 22 3a 20 7b 7d 2c 20 22 73 65 73 73 69 6f 6e 52 65 63 6f 72 64 69 6e 67 22 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 22 3a 20 22 2f 73 2f 22 2c 20 22 63 6f 6e 73 6f 6c 65 4c 6f 67 52 65 63 6f 72 64 69 6e 67 45 6e 61 62 6c 65 64 22 3a 20 74 72 75 65 2c 20 22 72 65 63 6f 72 64 65 72 56 65 72 73 69 Data Ascii: 3c7{"config": {"enable_collect_everything": true}, "toolbarParams": {}, "isAuthenticated": false, "supportedCompression": ["gzip", "gzip-js"], "featureFlags": {}, "sessionRecording": {"endpoint": "/s/", "consoleLogRecordingEnabled": true, "recorderVersi
2025-03-17 16:47:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	727	OUT	GET / HTTP/1.1 Host: enums.api.felloh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22anonymous%22%2C%22%24sesid%22%3A%5B1742230031089%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%7D
2025-03-17 16:47:14 UTC	547	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 2101 Connection: close Date: Mon, 17 Mar 2025 16:47:14 GMT Access-Control-Allow-Credentials: true x-amzn-RequestId: e5fad7e0-901f-4d62-9690-31fc4c809437 Access-Control-Allow-Origin: * x-amz-apigw-id: HlHC7HIYrPEEvNg= X-Amzn-Trace-Id: Root=1-67d85212-2578d7ed2543e2917650e4e7 X-Cache: Miss from cloudfront Via: 1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA50-C1 X-Amz-Cf-Id: dV6zI0YHF4_x4F5pCmYizuvOdccWyX2sK2a7E8Vho1EiZCV2X0z1hw==
2025-03-17 16:47:14 UTC	2101	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 75 72 72 65 6e 63 79 22 3a 7b 22 55 53 58 22 3a 7b 22 6d 69 6e 6f 72 5f 75 6e 69 74 22 3a 22 55 53 58 22 2c 22 6d 61 6a 6f 72 5f 75 6e 69 74 22 3a 22 55 53 44 22 2c 22 64 69 76 69 73 69 6f 6e 5f 66 61 63 74 6f 72 22 3a 31 30 30 7d 2c 22 45 55 58 22 3a 7b 22 6d 69 6e 6f 72 5f 75 6e 69 74 22 3a 22 45 55 58 22 2c 22 6d 61 6a 6f 72 5f 75 6e 69 74 22 3a 22 45 55 52 22 2c 22 64 69 76 69 73 69 6f 6e 5f 66 61 63 74 6f 72 22 3a 31 30 30 7d 2c 22 47 42 58 22 3a 7b 22 6d 69 6e 6f 72 5f 75 6e 69 74 22 3a 22 47 42 58 22 2c 22 6d 61 6a 6f 72 5f 75 6e 69 74 22 3a 22 47 42 50 22 2c 22 64 69 76 69 73 69 6f 6e 5f 66 61 63 74 6f 72 22 3a 31 30 30 7d 7d 2c 22 6f 72 67 61 6e 69 73 61 74 69 6f 6e 22 3a 7b 22 66 65 61 74 75 72 65 22 3a 5b 22 75 Data Ascii: {"data":{"currency":{"USX":{"minor_unit":"USX","major_unit":"USD","division_factor":100},"EUX":{"minor_unit":"EUX","major_unit":"EUR","division_factor":100},"GBX":{"minor_unit":"GBX","major_unit":"GBP","division_factor":100}},"organisation":{"feature":["u

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	565	OUT	GET /elements HTTP/1.1 Host: js.basistheory.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:47:14 UTC	480	IN	HTTP/1.1 302 Moved Temporarily Date: Mon, 17 Mar 2025 16:47:14 GMT Content-Type: text/html Content-Length: 143 Connection: close Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Location: https://js.basistheory.com/elements/v1/index.js Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 921df891ca49f5f6-EWR
2025-03-17 16:47:14 UTC	143	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	1469	OUT	POST /e/?compression=gzip-js&ip=1&_=1742230032493&ver=1.82.3 HTTP/1.1 Host: analytics.felloh.com Connection: keep-alive Content-Length: 637 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain sec-ch-ua-mobile: ?0 Accept: / Origin: https://pay.felloh.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22identified%22%2C%22%24sesid%22%3A%5B1742230032489%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%2C%22%24session_recording_enabled_server_side%22%3Atrue%2C%22%24console_log_recording_enabled_server_side%22%3Atrue%2C%22%24session_recording_recorder_version_server_side%22%3A%22v2%22%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%2C%22%24user_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24stored_person_properties%22%3A%7B%7D%7D
2025-03-17 16:47:14 UTC	637	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 54 5d 4f db 30 14 fd 2f 11 8f b8 38 4e d2 d8 7d db 18 6f 93 d0 04 6c 1a d3 64 39 f1 4d 63 48 ed c8 76 52 2a c4 7f df 75 57 8d 76 9a 34 78 8a 7d ee e7 b9 f7 38 cf d9 34 19 9d ad 32 9a 8b 4a 55 94 12 41 97 82 d4 ad d0 84 33 a6 c8 b2 e2 4a 37 a2 63 5a d4 d9 79 06 33 d8 88 ee 67 46 e3 c1 74 3b c4 46 ef 46 f0 d1 40 c8 56 cf d9 99 c3 4f f6 cd 58 ed b6 01 ad 78 97 33 f8 60 9c 45 3c a7 0b 9a c0 c6 a3 15 3c 22 97 bd 77 1b 48 98 86 d9 b4 20 e3 6e 04 c4 3f 41 78 8c 6e 4c 86 76 f2 1e ab c9 c9 0f 68 e8 63 1c c3 ea e2 62 54 bb 45 07 c3 e0 fa 45 eb 36 17 bc d2 bc ac 74 41 28 43 02 65 5e d7 44 55 9d 20 4b 55 56 e5 52 e4 9c 82 4a c9 7a 17 12 81 d3 e8 64 18 55 ec ad c2 56 56 d9 9b 93 1d 68 bc 12 cc 8b f2 08 1e 94 5d 4f 6a 9d 52 82 25 77 37 Data Ascii: T]O0/8N}old9McHvR*uWv4x}842JUA3J7cZy3gFt;FF@VOXx3`E<<"wH n?AxnLvhcbTEE6tA(Ce^DU KUVRJzdUVVh]OjR%w7
2025-03-17 16:47:14 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close X-Amz-Cf-Pop: FRA56-P5 Date: Mon, 17 Mar 2025 16:47:14 GMT server: envoy x-envoy-upstream-service-time: 7 access-control-allow-origin: https://pay.felloh.com access-control-allow-credentials: true access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: X-Requested-With,Content-Type vary: Origin, Accept-Encoding x-content-type-options: nosniff referrer-policy: same-origin cross-origin-opener-policy: same-origin Via: 1.1 ee6745944298a5956e13c939ebdcf8f2.cloudfront.net (CloudFront), 1.1 8e83c42d247a31c5b365c08a0352d8f8.cloudfront.net (CloudFront) X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: nnZqSUw0mOr7X6fBRZs7SdB94Ds5ZOFuG99aLiPgPIapKvBicikN_g==
2025-03-17 16:47:14 UTC	18	IN	Data Raw: 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 20 31 7d 0d 0a Data Ascii: d{"status": 1}
2025-03-17 16:47:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	1123	OUT	GET /e/?ip=1&_=1742230031009&ver=1.82.3 HTTP/1.1 Host: analytics.felloh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22anonymous%22%2C%22%24sesid%22%3A%5B1742230032342%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%2C%22%24session_recording_enabled_server_side%22%3Atrue%2C%22%24console_log_recording_enabled_server_side%22%3Atrue%2C%22%24session_recording_recorder_version_server_side%22%3A%22v2%22%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%7D
2025-03-17 16:47:14 UTC	608	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Transfer-Encoding: chunked Connection: close X-Amz-Cf-Pop: FRA56-P5 Date: Mon, 17 Mar 2025 16:47:14 GMT x-envoy-upstream-service-time: 3 x-content-type-options: nosniff referrer-policy: same-origin cross-origin-opener-policy: same-origin Server: envoy Via: 1.1 604f8ac78ed3ba5235c1a14794f2ac64.cloudfront.net (CloudFront), 1.1 8e83c42d247a31c5b365c08a0352d8f8.cloudfront.net (CloudFront) Vary: Accept-Encoding X-Cache: Error from cloudfront X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: WOSdSvTwzVbVUM5M-pwMCt-rzsAE-Wp3qIutiiwdVJTrhqZOFno40w==
2025-03-17 16:47:14 UTC	180	IN	Data Raw: 61 65 0d 0a 7b 22 74 79 70 65 22 3a 20 22 76 61 6c 69 64 61 74 69 6f 6e 5f 65 72 72 6f 72 22 2c 20 22 63 6f 64 65 22 3a 20 22 6e 6f 5f 64 61 74 61 22 2c 20 22 64 65 74 61 69 6c 22 3a 20 22 4e 6f 20 64 61 74 61 20 66 6f 75 6e 64 2e 20 4d 61 6b 65 20 73 75 72 65 20 74 6f 20 75 73 65 20 61 20 50 4f 53 54 20 72 65 71 75 65 73 74 20 77 68 65 6e 20 73 65 6e 64 69 6e 67 20 74 68 65 20 70 61 79 6c 6f 61 64 20 69 6e 20 74 68 65 20 62 6f 64 79 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 2e 22 2c 20 22 61 74 74 72 22 3a 20 6e 75 6c 6c 7d 0d 0a Data Ascii: ae{"type": "validation_error", "code": "no_data", "detail": "No data found. Make sure to use a POST request when sending the payload in the body of the request.", "attr": null}
2025-03-17 16:47:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	1132	OUT	GET /decide/?v=3&ip=1&_=1742230031010&ver=1.82.3 HTTP/1.1 Host: analytics.felloh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22anonymous%22%2C%22%24sesid%22%3A%5B1742230032342%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%2C%22%24session_recording_enabled_server_side%22%3Atrue%2C%22%24console_log_recording_enabled_server_side%22%3Atrue%2C%22%24session_recording_recorder_version_server_side%22%3A%22v2%22%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%7D
2025-03-17 16:47:14 UTC	598	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close X-Amz-Cf-Pop: FRA56-P5 Date: Mon, 17 Mar 2025 16:47:14 GMT x-envoy-upstream-service-time: 3 x-content-type-options: nosniff referrer-policy: same-origin cross-origin-opener-policy: same-origin Server: envoy Via: 1.1 83f46196ad7d99e4351e2a7adab8f174.cloudfront.net (CloudFront), 1.1 0363fab377de19b9b4f85394469f6fca.cloudfront.net (CloudFront) Vary: Accept-Encoding X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: jnO4_g74tlS_UBRkrcpssTX0895PEgQrvNXEomKR3sXUNWR_xR0SPA==
2025-03-17 16:47:14 UTC	192	IN	Data Raw: 62 61 0d 0a 7b 22 63 6f 6e 66 69 67 22 3a 20 7b 22 65 6e 61 62 6c 65 5f 63 6f 6c 6c 65 63 74 5f 65 76 65 72 79 74 68 69 6e 67 22 3a 20 74 72 75 65 7d 2c 20 22 74 6f 6f 6c 62 61 72 50 61 72 61 6d 73 22 3a 20 7b 7d 2c 20 22 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 73 75 70 70 6f 72 74 65 64 43 6f 6d 70 72 65 73 73 69 6f 6e 22 3a 20 5b 22 67 7a 69 70 22 2c 20 22 67 7a 69 70 2d 6a 73 22 5d 2c 20 22 66 65 61 74 75 72 65 46 6c 61 67 73 22 3a 20 5b 5d 2c 20 22 73 65 73 73 69 6f 6e 52 65 63 6f 72 64 69 6e 67 22 3a 20 66 61 6c 73 65 7d 0d 0a Data Ascii: ba{"config": {"enable_collect_everything": true}, "toolbarParams": {}, "isAuthenticated": false, "supportedCompression": ["gzip", "gzip-js"], "featureFlags": [], "sessionRecording": false}
2025-03-17 16:47:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	1632	OUT	POST /decide/?v=3&ip=1&_=1742230032564&ver=1.82.3 HTTP/1.1 Host: analytics.felloh.com Connection: keep-alive Content-Length: 373 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: / Origin: https://pay.felloh.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22identified%22%2C%22%24sesid%22%3A%5B1742230032497%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%2C%22%24session_recording_enabled_server_side%22%3Atrue%2C%22%24console_log_recording_enabled_server_side%22%3Atrue%2C%22%24session_recording_recorder_version_server_side%22%3A%22v2%22%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%2C%22%24user_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24stored_person_properties%22%3A%7B%22name%22%3A%22Doris%20Licht%22%7D%2C%22%24stored_group_properties%22%3A%7B%22company%22%3A%7B%7D%7D%2C%22%24groups%22%3A%7B%22company%22%3A%229203%22%7D%7D
2025-03-17 16:47:14 UTC	373	OUT	Data Raw: 64 61 74 61 3d 65 79 4a 30 62 32 74 6c 62 69 49 36 49 6e 42 6f 59 31 39 35 57 55 4a 56 51 58 56 31 4d 46 52 61 54 7a 4a 6d 55 58 6b 7a 63 6b 4e 54 4e 57 52 71 63 45 55 79 52 54 4e 30 56 6d 4a 6b 54 7a 6b 31 61 55 56 4d 65 58 52 6e 64 6c 51 34 49 69 77 69 5a 47 6c 7a 64 47 6c 75 59 33 52 66 61 57 51 69 4f 69 49 34 4e 57 51 34 4e 44 56 6b 4d 79 30 77 4d 6a 59 35 4c 54 51 78 4e 7a 63 74 59 54 56 6d 4f 53 30 32 59 54 51 31 4e 44 59 35 4d 54 67 77 5a 57 45 69 4c 43 4a 6e 63 6d 39 31 63 48 4d 69 4f 6e 73 69 59 32 39 74 63 47 46 75 65 53 49 36 49 6a 6b 79 4d 44 4d 69 66 53 77 69 4a 47 46 75 62 32 35 66 5a 47 6c 7a 64 47 6c 75 59 33 52 66 61 57 51 69 4f 69 49 77 4d 54 6b 31 59 54 55 77 4d 43 30 34 59 54 6c 6a 4c 54 63 31 4d 6a 4d 74 4f 54 41 79 5a 53 31 6b 4e 44 Data Ascii: data=eyJ0b2tlbiI6InBoY195WUJVQXV1MFRaTzJmUXkzckNTNWRqcEUyRTN0VmJkTzk1aUVMeXRndlQ4IiwiZGlzdGluY3RfaWQiOiI4NWQ4NDVkMy0wMjY5LTQxNzctYTVmOS02YTQ1NDY5MTgwZWEiLCJncm91cHMiOnsiY29tcGFueSI6IjkyMDMifSwiJGFub25fZGlzdGluY3RfaWQiOiIwMTk1YTUwMC04YTljLTc1MjMtOTAyZS1kND
2025-03-17 16:47:14 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close X-Amz-Cf-Pop: FRA56-P5 Date: Mon, 17 Mar 2025 16:47:14 GMT server: envoy x-envoy-upstream-service-time: 6 access-control-allow-origin: https://pay.felloh.com access-control-allow-credentials: true access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: X-Requested-With,Content-Type vary: Origin, Accept-Encoding x-content-type-options: nosniff referrer-policy: same-origin cross-origin-opener-policy: same-origin Via: 1.1 ee6745944298a5956e13c939ebdcf8f2.cloudfront.net (CloudFront), 1.1 0363fab377de19b9b4f85394469f6fca.cloudfront.net (CloudFront) X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: k4dHWzm3fcvzBu-uEXFXPwK48VS-d592kgGttMLXvtzVHD05l1wJzA==
2025-03-17 16:47:14 UTC	974	IN	Data Raw: 33 63 37 0d 0a 7b 22 63 6f 6e 66 69 67 22 3a 20 7b 22 65 6e 61 62 6c 65 5f 63 6f 6c 6c 65 63 74 5f 65 76 65 72 79 74 68 69 6e 67 22 3a 20 74 72 75 65 7d 2c 20 22 74 6f 6f 6c 62 61 72 50 61 72 61 6d 73 22 3a 20 7b 7d 2c 20 22 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 22 3a 20 66 61 6c 73 65 2c 20 22 73 75 70 70 6f 72 74 65 64 43 6f 6d 70 72 65 73 73 69 6f 6e 22 3a 20 5b 22 67 7a 69 70 22 2c 20 22 67 7a 69 70 2d 6a 73 22 5d 2c 20 22 66 65 61 74 75 72 65 46 6c 61 67 73 22 3a 20 7b 7d 2c 20 22 73 65 73 73 69 6f 6e 52 65 63 6f 72 64 69 6e 67 22 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 22 3a 20 22 2f 73 2f 22 2c 20 22 63 6f 6e 73 6f 6c 65 4c 6f 67 52 65 63 6f 72 64 69 6e 67 45 6e 61 62 6c 65 64 22 3a 20 74 72 75 65 2c 20 22 72 65 63 6f 72 64 65 72 56 65 72 73 69 Data Ascii: 3c7{"config": {"enable_collect_everything": true}, "toolbarParams": {}, "isAuthenticated": false, "supportedCompression": ["gzip", "gzip-js"], "featureFlags": {}, "sessionRecording": {"endpoint": "/s/", "consoleLogRecordingEnabled": true, "recorderVersi
2025-03-17 16:47:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	1259	OUT	GET /static/recorder-v2.js?v=1.82.3 HTTP/1.1 Host: analytics.felloh.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22anonymous%22%2C%22%24sesid%22%3A%5B1742230032342%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%2C%22%24session_recording_enabled_server_side%22%3Atrue%2C%22%24console_log_recording_enabled_server_side%22%3Atrue%2C%22%24session_recording_recorder_version_server_side%22%3A%22v2%22%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%7D
2025-03-17 16:47:14 UTC	635	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 115223 Connection: close Date: Mon, 17 Mar 2025 16:47:15 GMT Last-Modified: Mon, 17 Mar 2025 16:36:43 GMT ETag: "112ae098441fbdb4f6b2ca72b030af53" x-amz-server-side-encryption: AES256 x-amz-version-id: phav7oYd7EXxggx35HqFgVU.9jWa7i9B Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront), 1.1 a23dafbbb9a61c77bda1d66d97f24e2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P5 X-Cache: Miss from cloudfront X-Amz-Cf-Pop: FRA56-C2 X-Amz-Cf-Id: 79M_oplYuzuZa-9vJSvnPYKF9j8E9XGOCwu646WazxBBGGC61-_E5w==
2025-03-17 16:47:14 UTC	14024	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6e 3d 6e 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 74 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 29 2c 72 2e 70 75 73 68 2e 61 70 70 6c 79 28 72 2c 6e 29 7d 72 65 74 75 72 6e 20 72 7d 66 75 6e 63 74 69 6f 6e Data Ascii: !function(){"use strict";function e(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function
2025-03-17 16:47:14 UTC	2929	IN	Data Raw: 6c 65 3a 63 2c 72 6f 6f 74 49 64 3a 61 7d 7d 28 65 2c 7b 64 6f 63 3a 72 2c 6e 65 65 64 73 4d 61 73 6b 3a 69 2c 6d 61 73 6b 54 65 78 74 46 6e 3a 63 2c 72 6f 6f 74 49 64 3a 76 7d 29 3b 63 61 73 65 20 65 2e 43 44 41 54 41 5f 53 45 43 54 49 4f 4e 5f 4e 4f 44 45 3a 72 65 74 75 72 6e 7b 74 79 70 65 3a 68 2e 43 44 41 54 41 2c 74 65 78 74 43 6f 6e 74 65 6e 74 3a 22 22 2c 72 6f 6f 74 49 64 3a 76 7d 3b 63 61 73 65 20 65 2e 43 4f 4d 4d 45 4e 54 5f 4e 4f 44 45 3a 72 65 74 75 72 6e 7b 74 79 70 65 3a 68 2e 43 6f 6d 6d 65 6e 74 2c 74 65 78 74 43 6f 6e 74 65 6e 74 3a 43 2e 74 65 78 74 43 6f 6e 74 65 6e 74 28 65 29 7c 7c 22 22 2c 72 6f 6f 74 49 64 3a 76 7d 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 65 28 65 29 7b 72 65 74 75 72 Data Ascii: le:c,rootId:a}}(e,{doc:r,needsMask:i,maskTextFn:c,rootId:v});case e.CDATA_SECTION_NODE:return{type:h.CDATA,textContent:"",rootId:v};case e.COMMENT_NODE:return{type:h.Comment,textContent:C.textContent(e)\|\|"",rootId:v};default:return!1}}function re(e){retur
2025-03-17 16:47:14 UTC	16384	IN	Data Raw: 65 78 74 7c 7c 78 2e 69 73 53 74 79 6c 65 7c 7c 78 2e 74 65 78 74 43 6f 6e 74 65 6e 74 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 73 2b 7c 5c 73 2b 24 2f 67 6d 2c 22 22 29 2e 6c 65 6e 67 74 68 29 3f 50 28 29 3a 48 3b 76 61 72 20 44 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 78 2c 7b 69 64 3a 4f 7d 29 3b 69 66 28 6e 2e 61 64 64 28 65 2c 44 29 2c 4f 3d 3d 3d 48 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 79 26 26 79 28 65 29 3b 76 61 72 20 46 3d 21 6c 3b 69 66 28 44 2e 74 79 70 65 3d 3d 3d 68 2e 45 6c 65 6d 65 6e 74 29 7b 46 3d 46 26 26 21 44 2e 6e 65 65 64 42 6c 6f 63 6b 2c 64 65 6c 65 74 65 20 44 2e 6e 65 65 64 42 6c 6f 63 6b 3b 76 61 72 20 42 3d 43 2e 73 68 61 64 6f 77 52 6f 6f 74 28 65 29 3b 42 26 26 4e 28 42 29 26 26 28 44 2e 69 73 53 68 61 64 6f 77 48 6f 73 74 Data Ascii: ext\|\|x.isStyle\|\|x.textContent.replace(/^\s+\|\s+$/gm,"").length)?P():H;var D=Object.assign(x,{id:O});if(n.add(e,D),O===H)return null;y&&y(e);var F=!l;if(D.type===h.Element){F=F&&!D.needBlock,delete D.needBlock;var B=C.shadowRoot(e);B&&N(B)&&(D.isShadowHost
2025-03-17 16:47:14 UTC	15990	IN	Data Raw: 69 6f 6e 28 72 29 2c 7b 69 64 3a 74 68 69 73 2e 6d 69 72 72 6f 72 2e 67 65 74 49 64 28 74 29 2c 76 61 6c 75 65 3a 65 2e 76 61 6c 75 65 7d 7d 29 29 2e 66 69 6c 74 65 72 28 28 65 3d 3e 21 74 2e 68 61 73 28 65 2e 69 64 29 29 29 2e 66 69 6c 74 65 72 28 28 65 3d 3e 74 68 69 73 2e 6d 69 72 72 6f 72 2e 68 61 73 28 65 2e 69 64 29 29 29 2c 61 74 74 72 69 62 75 74 65 73 3a 74 68 69 73 2e 61 74 74 72 69 62 75 74 65 73 2e 6d 61 70 28 28 65 3d 3e 7b 76 61 72 7b 61 74 74 72 69 62 75 74 65 73 3a 74 7d 3d 65 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 2e 73 74 79 6c 65 29 7b 76 61 72 20 72 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 2e 73 74 79 6c 65 44 69 66 66 29 2c 6e 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 2e 5f 75 6e 63 68 61 Data Ascii: ion(r),{id:this.mirror.getId(t),value:e.value}})).filter((e=>!t.has(e.id))).filter((e=>this.mirror.has(e.id))),attributes:this.attributes.map((e=>{var{attributes:t}=e;if("string"==typeof t.style){var r=JSON.stringify(e.styleDiff),n=JSON.stringify(e._uncha
2025-03-17 16:47:14 UTC	4172	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 73 65 72 74 52 75 6c 65 3d 75 5b 74 5d 2e 69 6e 73 65 72 74 52 75 6c 65 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 52 75 6c 65 3d 75 5b 74 5d 2e 64 65 6c 65 74 65 52 75 6c 65 7d 29 29 7d 29 29 7d 28 65 2c 7b 77 69 6e 3a 6f 7d 29 2c 68 3d 6c 74 28 65 2c 65 2e 64 6f 63 29 2c 70 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 7b 73 74 79 6c 65 44 65 63 6c 61 72 61 74 69 6f 6e 43 62 3a 72 2c 6d 69 72 72 6f 72 3a 6e 2c 69 67 6e 6f 72 65 43 53 53 41 74 74 72 69 62 75 74 65 73 3a 6f 2c 73 74 79 6c 65 73 68 65 65 74 4d 61 6e 61 67 65 72 3a 61 7d 3d 65 2c 7b 77 69 6e 3a 69 7d 3d 74 2c 73 3d 69 2e 43 53 53 53 74 79 6c 65 44 65 63 6c 61 72 61 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 50 72 6f 70 Data Ascii: .prototype.insertRule=u[t].insertRule,r.prototype.deleteRule=u[t].deleteRule}))}))}(e,{win:o}),h=lt(e,e.doc),p=function(e,t){var{styleDeclarationCb:r,mirror:n,ignoreCSSAttributes:o,stylesheetManager:a}=e,{win:i}=t,s=i.CSSStyleDeclaration.prototype.setProp
2025-03-17 16:47:14 UTC	16384	IN	Data Raw: 65 65 74 4d 61 6e 61 67 65 72 22 29 2c 63 28 74 68 69 73 2c 22 72 65 63 6f 72 64 43 72 6f 73 73 4f 72 69 67 69 6e 49 66 72 61 6d 65 73 22 29 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 43 62 3d 65 2e 6d 75 74 61 74 69 6f 6e 43 62 2c 74 68 69 73 2e 77 72 61 70 70 65 64 45 6d 69 74 3d 65 2e 77 72 61 70 70 65 64 45 6d 69 74 2c 74 68 69 73 2e 73 74 79 6c 65 73 68 65 65 74 4d 61 6e 61 67 65 72 3d 65 2e 73 74 79 6c 65 73 68 65 65 74 4d 61 6e 61 67 65 72 2c 74 68 69 73 2e 72 65 63 6f 72 64 43 72 6f 73 73 4f 72 69 67 69 6e 49 66 72 61 6d 65 73 3d 65 2e 72 65 63 6f 72 64 43 72 6f 73 73 4f 72 69 67 69 6e 49 66 72 61 6d 65 73 2c 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 49 66 72 61 6d 65 53 74 79 6c 65 4d 69 72 72 6f 72 3d 6e 65 77 20 68 74 28 74 68 69 73 2e 73 Data Ascii: eetManager"),c(this,"recordCrossOriginIframes"),this.mutationCb=e.mutationCb,this.wrappedEmit=e.wrappedEmit,this.stylesheetManager=e.stylesheetManager,this.recordCrossOriginIframes=e.recordCrossOriginIframes,this.crossOriginIframeStyleMirror=new ht(this.s
2025-03-17 16:47:14 UTC	16384	IN	Data Raw: 74 61 6d 70 73 2e 6c 61 74 65 73 74 49 64 3d 74 2c 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 65 29 7d 3b 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 65 29 7d 66 6c 75 73 68 50 65 6e 64 69 6e 67 43 61 6e 76 61 73 4d 75 74 61 74 69 6f 6e 73 28 29 7b 74 68 69 73 2e 70 65 6e 64 69 6e 67 43 61 6e 76 61 73 4d 75 74 61 74 69 6f 6e 73 2e 66 6f 72 45 61 63 68 28 28 28 65 2c 74 29 3d 3e 7b 76 61 72 20 72 3d 74 68 69 73 2e 6d 69 72 72 6f 72 2e 67 65 74 49 64 28 74 29 3b 74 68 69 73 2e 66 6c 75 73 68 50 65 6e 64 69 6e 67 43 61 6e 76 61 73 4d 75 74 61 74 69 6f 6e 46 6f 72 28 74 2c 72 29 7d 29 29 2c 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 28 28 29 3d 3e 74 68 69 73 2e 66 6c 75 73 68 50 65 6e 64 69 Data Ascii: tamps.latestId=t,requestAnimationFrame(e)};requestAnimationFrame(e)}flushPendingCanvasMutations(){this.pendingCanvasMutations.forEach(((e,t)=>{var r=this.mirror.getId(t);this.flushPendingCanvasMutationFor(t,r)})),requestAnimationFrame((()=>this.flushPendi
2025-03-17 16:47:14 UTC	16384	IN	Data Raw: 6e 5d 3d 6f 2c 6f 2e 62 69 6e 64 28 74 29 29 7d 76 61 72 20 6d 72 3d 7b 63 68 69 6c 64 4e 6f 64 65 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 75 72 28 22 4e 6f 64 65 22 2c 65 2c 22 63 68 69 6c 64 4e 6f 64 65 73 22 29 7d 2c 70 61 72 65 6e 74 4e 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 75 72 28 22 4e 6f 64 65 22 2c 65 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 29 7d 2c 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 75 72 28 22 4e 6f 64 65 22 2c 65 2c 22 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 22 29 7d 2c 74 65 78 74 43 6f 6e 74 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 75 72 28 22 4e 6f 64 65 22 2c 65 2c 22 74 65 78 74 43 6f 6e 74 65 6e Data Ascii: n]=o,o.bind(t))}var mr={childNodes:function(e){return ur("Node",e,"childNodes")},parentNode:function(e){return ur("Node",e,"parentNode")},parentElement:function(e){return ur("Node",e,"parentElement")},textContent:function(e){return ur("Node",e,"textConten
2025-03-17 16:47:14 UTC	11244	IN	Data Raw: 65 6e 74 3f 74 3f 74 2e 6f 75 74 65 72 48 54 4d 4c 3a 22 22 3a 74 2e 6e 6f 64 65 4e 61 6d 65 3a 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 3f 74 2e 73 74 61 63 6b 3f 74 2e 73 74 61 63 6b 2b 22 5c 6e 45 6e 64 20 6f 66 20 73 74 61 63 6b 20 66 6f 72 20 45 72 72 6f 72 20 6f 62 6a 65 63 74 22 3a 74 2e 6e 61 6d 65 2b 22 3a 20 22 2b 74 2e 6d 65 73 73 61 67 65 3a 74 7d 29 29 7d 76 61 72 20 5a 72 3d 7b 6c 65 76 65 6c 3a 5b 22 61 73 73 65 72 74 22 2c 22 63 6c 65 61 72 22 2c 22 63 6f 75 6e 74 22 2c 22 63 6f 75 6e 74 52 65 73 65 74 22 2c 22 64 65 62 75 67 22 2c 22 64 69 72 22 2c 22 64 69 72 78 6d 6c 22 2c 22 65 72 72 6f 72 22 2c 22 67 72 6f 75 70 22 2c 22 67 72 6f 75 70 43 6f 6c 6c 61 70 73 65 64 22 2c 22 67 72 6f 75 70 45 6e 64 22 2c 22 69 6e 66 6f 22 2c Data Ascii: ent?t?t.outerHTML:"":t.nodeName:t instanceof Error?t.stack?t.stack+"\nEnd of stack for Error object":t.name+": "+t.message:t}))}var Zr={level:["assert","clear","count","countReset","debug","dir","dirxml","error","group","groupCollapsed","groupEnd","info",
2025-03-17 16:47:14 UTC	1328	IN	Data Raw: 6e 64 28 70 29 3b 70 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 3d 28 65 2c 74 29 3d 3e 28 67 5b 65 5d 3d 74 2c 76 28 65 2c 74 29 29 2c 6e 26 26 28 66 2e 72 65 71 75 65 73 74 48 65 61 64 65 72 73 3d 67 29 3b 76 61 72 20 79 3d 70 2e 73 65 6e 64 2e 62 69 6e 64 28 70 29 3b 70 2e 73 65 6e 64 3d 65 3d 3e 28 62 6e 28 7b 74 79 70 65 3a 22 72 65 71 75 65 73 74 22 2c 68 65 61 64 65 72 73 3a 67 2c 75 72 6c 3a 73 2c 72 65 63 6f 72 64 42 6f 64 79 3a 72 2e 72 65 63 6f 72 64 42 6f 64 79 7d 29 26 26 28 66 2e 72 65 71 75 65 73 74 42 6f 64 79 3d 77 6e 28 7b 62 6f 64 79 3a 65 2c 6f 70 74 69 6f 6e 73 3a 72 2c 75 72 6c 3a 73 7d 29 29 2c 6c 3d 74 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 2c 79 28 65 29 29 2c 70 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e Data Ascii: nd(p);p.setRequestHeader=(e,t)=>(g[e]=t,v(e,t)),n&&(f.requestHeaders=g);var y=p.send.bind(p);p.send=e=>(bn({type:"request",headers:g,url:s,recordBody:r.recordBody})&&(f.requestBody=wn({body:e,options:r,url:s})),l=t.performance.now(),y(e)),p.addEventListen

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	1568	OUT	GET /organisation/9203.png HTTP/1.1 Host: assets.felloh.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pay.felloh.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22identified%22%2C%22%24sesid%22%3A%5B1742230032497%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%2C%22%24session_recording_enabled_server_side%22%3Atrue%2C%22%24console_log_recording_enabled_server_side%22%3Atrue%2C%22%24session_recording_recorder_version_server_side%22%3A%22v2%22%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%2C%22%24user_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24stored_person_properties%22%3A%7B%22name%22%3A%22Doris%20Licht%22%7D%2C%22%24stored_group_properties%22%3A%7B%22company%22%3A%7B%7D%7D%2C%22%24groups%22%3A%7B%22company%22%3A%229203%22%7D%7D
2025-03-17 16:47:14 UTC	467	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 13020 Connection: close Date: Mon, 17 Mar 2025 16:47:15 GMT Content-Encoding: base64 Last-Modified: Tue, 03 Dec 2024 11:34:42 GMT ETag: "5e216051e156dc6cdb41551ea5c2b8bf" Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 14b30c40b56ef4c9699e1ca92d5cdc08.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P5 X-Amz-Cf-Id: 14vLe_DzOFd8AKomZFx6Zwqt8BgmO72IFuJy9D3HG3MeJ-NRZZBvjw==
2025-03-17 16:47:14 UTC	12888	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 7a 00 00 00 f4 08 06 00 00 00 0c 8f 8b 8d 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 06 20 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 32 20 37 39 2e 62 37 63 36 34 63 63 66 39 2c 20 32 30 32 34 2f 30 37 2f 31 36 2d 31 32 3a 33 39 3a 30 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 Data Ascii: PNGIHDRzpHYs.#.#x?v iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf
2025-03-17 16:47:14 UTC	132	IN	Data Raw: 33 3f 57 db 28 fc 7b cb 8e 16 b5 44 44 67 e7 45 5d 77 6a a1 b7 69 e3 3c 32 03 e0 2f bc 7c f2 ae f0 67 41 78 81 fa 09 b1 3c ba c1 81 db 28 80 ac 7f d3 b6 af a9 c1 ee 33 01 0b d4 5f f3 0a f5 d7 bd 44 fd 35 2f 84 ba 48 44 44 44 1d 72 b0 d0 23 22 22 22 a2 61 38 6a 8d 1e 11 11 11 11 75 1f 0b 3d 22 22 22 a2 81 62 a1 47 44 44 44 34 50 ff 1f 84 c3 e9 89 0f 04 ad 7c 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: 3?W({DDgE]wji<2/\|gAx<(3_D5/HDDDr#"""a8ju="""bGDDD4P\|IENDB`

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:47:14 UTC	1423	OUT	GET /payment/payment-link/85d845d3-0269-4177-a5f9-6a45469180ea?method=ONLINE HTTP/1.1 Host: payment.api.felloh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: ph_phc_yYBUAuu0TZO2fQy3rCS5djpE2E3tVbdO95iELytgvT8_posthog=%7B%22distinct_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24device_id%22%3A%220195a500-8a9c-7523-902e-d495b7bd2235%22%2C%22%24user_state%22%3A%22identified%22%2C%22%24sesid%22%3A%5B1742230032497%2C%220195a500-8aa0-7fec-97f2-8332f269389f%22%2C1742230031008%5D%2C%22%24session_recording_enabled_server_side%22%3Atrue%2C%22%24console_log_recording_enabled_server_side%22%3Atrue%2C%22%24session_recording_recorder_version_server_side%22%3A%22v2%22%2C%22%24autocapture_disabled_server_side%22%3Afalse%2C%22%24active_feature_flags%22%3A%5B%5D%2C%22%24enabled_feature_flags%22%3A%7B%7D%2C%22%24feature_flag_payloads%22%3A%7B%7D%2C%22%24user_id%22%3A%2285d845d3-0269-4177-a5f9-6a45469180ea%22%2C%22%24stored_person_properties%22%3A%7B%22name%22%3A%22Doris%20Licht%22%7D%2C%22%24stored_group_properties%22%3A%7B%22company%22%3A%7B%7D%7D%2C%22%24groups%22%3A%7B%22company%22%3A%229203%22%7D%7D
2025-03-17 16:47:14 UTC	547	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1082 Connection: close Date: Mon, 17 Mar 2025 16:47:14 GMT Access-Control-Allow-Credentials: true x-amzn-RequestId: 90474af9-3801-406e-95ce-66ca9d04ef75 Access-Control-Allow-Origin: * x-amz-apigw-id: HlHC-He1rPEElug= X-Amzn-Trace-Id: Root=1-67d85212-1c8ab8693c6250e008eeec32 X-Cache: Miss from cloudfront Via: 1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P3 X-Amz-Cf-Id: 37NtnSfS7K3AzEF8jqfLq90IUhNNFfsDQMO1q6jUmCXDMhsPwV-65g==
2025-03-17 16:47:14 UTC	1082	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 22 38 35 64 38 34 35 64 33 2d 30 32 36 39 2d 34 31 37 37 2d 61 35 66 39 2d 36 61 34 35 34 36 39 31 38 30 65 61 22 2c 22 61 6d 6f 75 6e 74 22 3a 31 33 34 34 30 30 30 2c 22 63 75 72 72 65 6e 63 79 22 3a 22 55 53 58 22 2c 22 63 75 73 74 6f 6d 65 72 5f 6e 61 6d 65 22 3a 22 44 6f 72 69 73 20 4c 69 63 68 74 22 2c 22 63 75 73 74 6f 6d 65 72 22 3a 7b 22 69 64 22 3a 22 34 35 34 32 66 30 62 61 2d 38 65 31 61 2d 34 65 63 35 2d 61 36 30 32 2d 30 34 35 65 38 39 66 34 38 34 63 64 22 2c 22 63 75 73 74 6f 6d 65 72 5f 6e 61 6d 65 22 3a 22 44 6f 72 69 73 20 4c 69 63 68 74 22 2c 22 65 6d 61 69 6c 22 3a 22 64 6f 72 69 73 40 6c 69 63 68 74 77 65 62 2e 63 6f 6d 22 2c 22 61 64 64 72 65 73 73 5f 31 22 3a 6e 75 6c 6c 2c 22 61 64 64 72 65 Data Ascii: {"data":{"id":"85d845d3-0269-4177-a5f9-6a45469180ea","amount":1344000,"currency":"USX","customer_name":"Doris Licht","customer":{"id":"4542f0ba-8e1a-4ec5-a602-045e89f484cd","customer_name":"Doris Licht","email":"doris@lichtweb.com","address_1":null,"addre