Edit tour

Windows Analysis Report
https://gemini_logip.godaddysites.com/

Overview

General Information

Sample URL:	https://gemini_logip.godaddysites.com/
Analysis ID:	1521847
Tags:	openphish
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1964,i,14964113352374650661,4813199552823465559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gemini_logip.godaddysites.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1727577561007&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: https://gemini_logip.godaddysites.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://gemini_logip.godaddysites.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://gemini_logip.godaddysites.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49745 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: gemini_logip.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: ms.godaddy.com
Source: global traffic	DNS traffic detected: DNS query: www.godaddy.com
Source: global traffic	DNS traffic detected: DNS query: api.ola.godaddy.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 02:40:02 GMTContent-Type: application/json; charset=utf-8Content-Length: 29Connection: closeaccess-control-allow-origin: https://gemini_logip.godaddysites.comaccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEADaccess-control-expose-headers: access-control-max-age: 7200access-control-allow-credentials: trueX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheX-Request-Id: c6d0d052e29acfa4805d18a3261718f3X-Runtime: 0.004971vary: Accept, OriginStrict-Transport-Security: max-age=15724800; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 02:40:11 GMTContent-Type: application/json; charset=utf-8Content-Length: 29Connection: closeaccess-control-allow-origin: https://gemini_logip.godaddysites.comaccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEADaccess-control-expose-headers: access-control-max-age: 7200access-control-allow-credentials: trueX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheX-Request-Id: 93d8697bc5ae04de45f8f8acf4af69b1X-Runtime: 0.004026vary: Accept, OriginStrict-Transport-Security: max-age=15724800; includeSubDomains

Source: chromecache_210.2.dr, chromecache_302.2.dr, chromecache_226.2.dr, chromecache_296.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_243.2.dr, chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/gudea/v15/neIFzCqgsI0mp9CG_oC-Nw.woff2)
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/gudea/v15/neIFzCqgsI0mp9CI_oA.woff2)
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/gudea/v15/neIIzCqgsI0mp9gz25WBFqw.woff2)
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/gudea/v15/neIIzCqgsI0mp9gz25WPFqwKUQ.woff2)
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/gudea/v15/neILzCqgsI0mp9CNzoKmMw.woff2)
Source: chromecache_268.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/gudea/v15/neILzCqgsI0mp9CNzoymM5Ez.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q-bHNiZg.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q0bHNiZg.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q1bHNiZg.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q3bHNiZg.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVep1q4dHc.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepFq4dHc.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepVq4dHc.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2)
Source: chromecache_199.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVerlq4dHc.woff2)
Source: chromecache_219.2.dr	String found in binary or memory: https://gemini_logip.godaddysites.com/
Source: chromecache_201.2.dr	String found in binary or memory: https://gemini_logip.godaddysites.com/contact-us
Source: chromecache_200.2.dr	String found in binary or memory: https://gemini_logip.godaddysites.com/faq
Source: chromecache_243.2.dr	String found in binary or memory: https://gemini_logip.godaddysites.com/services
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/gudea/v15/neIFzCqgsI0mp9CG_oC-Nw.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/gudea/v15/neIFzCqgsI0mp9CI_oA.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/gudea/v15/neIIzCqgsI0mp9gz25WBFqw.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/gudea/v15/neIIzCqgsI0mp9gz25WPFqwKUQ.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/gudea/v15/neILzCqgsI0mp9CNzoKmMw.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/gudea/v15/neILzCqgsI0mp9CNzoymM5Ez.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q-bHNiZg.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q0bHNiZg.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q1bHNiZg.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q3bHNiZg.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVep1q4dHc.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepFq4dHc.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepVq4dHc.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2)
Source: chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVerlq4dHc.woff2)
Source: chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/gemini-login-.png
Source: chromecache_243.2.dr, chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_300.2.dr, chromecache_239.2.dr	String found in binary or memory: https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjoz
Source: chromecache_300.2.dr, chromecache_239.2.dr	String found in binary or memory: https://ms.godaddy.com/r?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2
Source: chromecache_243.2.dr, chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	String found in binary or memory: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applica

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1964,i,14964113352374650661,4813199552823465559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gemini_logip.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1964,i,14964113352374650661,4813199552823465559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://gemini_logip.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
Source: global traffic	HTTP traffic detected: GET /faq HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjE2ZjcxYzY1MzZkZjRmMjA4MmNlODFkMjYyYzM4OWUyIiwiZGoiOjAsImlpIjoiN2Q2N2NhNTQ1YjAxNDAxMGFkNDY0MmNmMzY5YzMwMTMiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyMDA5MjAwLCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtYTIyNmU2NjQwMWU4NDFkOGI1NzE5OGRjZmRjYmYyMjEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzU5MDM2MCwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=O0ZB0yHIDrTqQ88Kx_Fc-320MxQ&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21 HTTP/1.1Host: ms.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /contact-us HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjE2ZjcxYzY1MzZkZjRmMjA4MmNlODFkMjYyYzM4OWUyIiwiZGoiOjAsImlpIjoiN2Q2N2NhNTQ1YjAxNDAxMGFkNDY0MmNmMzY5YzMwMTMiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyMDA5MjAwLCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtYTIyNmU2NjQwMWU4NDFkOGI1NzE5OGRjZmRjYmYyMjEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzU5MDM2MCwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=O0ZB0yHIDrTqQ88Kx_Fc-320MxQ&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21 HTTP/1.1Host: ms.godaddy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: azk=ue1-a226e66401e841d8b57198dcfdcbf221; azk-ss=true
Source: global traffic	HTTP traffic detected: GET /services HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/servicesAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=2&C_TOUCH=2024-09-29T02:39:58.438Z
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://gemini_logip.godaddysites.com/sw.jsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=2&C_TOUCH=2024-09-29T02:39:58.438ZIf-None-Match: 4c26bd2f89896c19bab99604434afdbc
Source: global traffic	HTTP traffic detected: GET /accounts/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/config HTTP/1.1Host: api.ola.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;charset=UTF-8Origin: https://gemini_logip.godaddysites.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=2&C_TOUCH=2024-09-29T02:39:58.438Z
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjFhNzE3YTc3ODJkNjRlNmM5ZDE2OGM2NzE1ZjAwM2Y2IiwiZGoiOjAsImlpIjoiN2I3MjI2YjEwYzRlNGNiYWJlNDRiYWU2ZjU5MzEwMmMiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMDQxNjM4LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzRjNzFlMzVjY2JjNGJlZjk4MGI2ZDZhMjQwODdjMTMiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzYwMjc2NiwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=6mk4uf6kNYs3G_8pCQfSNajh5_Y&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21 HTTP/1.1Host: ms.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: azk=ue1-a226e66401e841d8b57198dcfdcbf221; azk-ss=true
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/faqAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=3&C_TOUCH=2024-09-29T02:40:04.804Z
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=3&C_TOUCH=2024-09-29T02:40:04.804Z
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6ImE4Y2RiMzJmZmNhODQwMjU5ZjY3YWQwYmVjNGJhNDRmIiwiZGoiOjAsImlpIjoiMDVmMmY4YTEwYjM3NDgyOWE3MTBiZjEyNjFjMzBhMGQiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMDQ3NTY3LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtYzQxY2FhZTFiODAxNDEyYWJhYzI0ZjdjNGUxZTkzZjgiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzYwODE5MCwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=kRe9BLUyE9MxUxVuO1JpFk_kRWg&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21 HTTP/1.1Host: ms.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: azk-ss=true; azk=ue1-34c71e35ccbc4bef980b6d6a24087c13
Source: global traffic	HTTP traffic detected: GET /v2/accounts/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/categories HTTP/1.1Host: api.ola.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;charset=UTF-8Origin: https://gemini_logip.godaddysites.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/contact-usAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=4&C_TOUCH=2024-09-29T02:40:11.574Z
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjQ1NmUyZjVkODBhOTRjY2ViYjlhNWFhMWIyNmVmNzA3IiwiZGoiOjAsImlpIjoiN2M2OTk5YmMxYzcwNGZiYThmYTQ1ZTZlMjFkMWRiNmQiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyMDM3NTUzLCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtZGJhOGEzN2FhZWU2NGVhYThjMzgyNWU2MDdjMDZlMzEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzYxNDAyMywicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=2DgoOwp_fMVVqIQ5imUSMskq2gg&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21 HTTP/1.1Host: ms.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://gemini_logip.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: azk-ss=true; azk=ue1-c41caae1b801412abac24f7c4e1e93f8
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=4&C_TOUCH=2024-09-29T02:40:11.574Z
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: gemini_logip.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://gemini_logip.godaddysites.com/sw.jsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=4&C_TOUCH=2024-09-29T02:40:11.574ZIf-None-Match: 4c26bd2f89896c19bab99604434afdbc

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://scripts.sil.org/OFL	0%	URL Reputation	safe
http://jedwatson.github.io/classnames	0%	URL Reputation	safe

IP	Domain	Country	ASN	ASN Name	Malicious
3.121.64.201	isteam.wsimg.com	United States	16509	AMAZON-02US	false
13.248.243.5	gemini_logip.godaddysites.com	United States	16509	AMAZON-02US	false
198.71.248.123	proxy.k8s.pnc.iad.secureserver.net	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
34.250.180.246	e-prod-alb-s102-eu-west-1-02.adzerk.net	United States	16509	AMAZON-02US	false

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Name	IP	Active	Malicious	Reputation
e-prod-alb-s102-eu-west-1-02.adzerk.net	34.250.180.246	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
gemini_logip.godaddysites.com	13.248.243.5	true	false	unknown
isteam.wsimg.com	3.121.64.201	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
proxy.k8s.pnc.iad.secureserver.net	198.71.248.123	true	false	unknown
img1.wsimg.com	unknown	unknown	false	unknown
csp.secureserver.net	unknown	unknown	false	unknown
events.api.secureserver.net	unknown	unknown	false	unknown
www.godaddy.com	unknown	unknown	false	unknown
ms.godaddy.com	unknown	unknown	false	unknown
api.ola.godaddy.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjQ1NmUyZjVkODBhOTRjY2ViYjlhNWFhMWIyNmVmNzA3IiwiZGoiOjAsImlpIjoiN2M2OTk5YmMxYzcwNGZiYThmYTQ1ZTZlMjFkMWRiNmQiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyMDM3NTUzLCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtZGJhOGEzN2FhZWU2NGVhYThjMzgyNWU2MDdjMDZlMzEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzYxNDAyMywicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=2DgoOwp_fMVVqIQ5imUSMskq2gg&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21	false	unknown
https://gemini_logip.godaddysites.com/contact-us	true	unknown
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6ImE4Y2RiMzJmZmNhODQwMjU5ZjY3YWQwYmVjNGJhNDRmIiwiZGoiOjAsImlpIjoiMDVmMmY4YTEwYjM3NDgyOWE3MTBiZjEyNjFjMzBhMGQiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMDQ3NTY3LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtYzQxY2FhZTFiODAxNDEyYWJhYzI0ZjdjNGUxZTkzZjgiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzYwODE5MCwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=kRe9BLUyE9MxUxVuO1JpFk_kRWg&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21	false	unknown
https://gemini_logip.godaddysites.com/markup/ad	true	unknown
https://gemini_logip.godaddysites.com/faq	true	unknown
https://gemini_logip.godaddysites.com/sw.js	true	unknown
https://api.ola.godaddy.com/v2/accounts/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/categories	false	unknown
https://api.ola.godaddy.com/accounts/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/config	false	unknown
https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-in_corp_applications_base	false	unknown
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjFhNzE3YTc3ODJkNjRlNmM5ZDE2OGM2NzE1ZjAwM2Y2IiwiZGoiOjAsImlpIjoiN2I3MjI2YjEwYzRlNGNiYWJlNDRiYWU2ZjU5MzEwMmMiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMDQxNjM4LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzRjNzFlMzVjY2JjNGJlZjk4MGI2ZDZhMjQwODdjMTMiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzYwMjc2NiwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=6mk4uf6kNYs3G_8pCQfSNajh5_Y&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21	false	unknown
https://gemini_logip.godaddysites.com/	true	unknown
https://gemini_logip.godaddysites.com/manifest.webmanifest	true	unknown
https://api.ola.godaddy.com/accounts	false	unknown
https://gemini_logip.godaddysites.com/services	true	unknown
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjE2ZjcxYzY1MzZkZjRmMjA4MmNlODFkMjYyYzM4OWUyIiwiZGoiOjAsImlpIjoiN2Q2N2NhNTQ1YjAxNDAxMGFkNDY0MmNmMzY5YzMwMTMiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyMDA5MjAwLCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtYTIyNmU2NjQwMWU4NDFkOGI1NzE5OGRjZmRjYmYyMjEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzU5MDM2MCwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=O0ZB0yHIDrTqQ88Kx_Fc-320MxQ&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepFq4dHc.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://ms.godaddy.com/r?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2	chromecache_300.2.dr, chromecache_239.2.dr	false		unknown
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjoz	chromecache_300.2.dr, chromecache_239.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/gudea/v15/neIFzCqgsI0mp9CG_oC-Nw.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q3bHNiZg.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applica	chromecache_243.2.dr, chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVep1q4dHc.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/gudea/v15/neIFzCqgsI0mp9CI_oA.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepVq4dHc.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q0bHNiZg.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/gudea/v15/neILzCqgsI0mp9CNzoymM5Ez.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc	chromecache_243.2.dr, chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q1bHNiZg.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/gudea/v15/neIIzCqgsI0mp9gz25WBFqw.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVerlq4dHc.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
http://scripts.sil.org/OFL	chromecache_243.2.dr, chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false	URL Reputation: safe	unknown
https://img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/gemini-login-.png	chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/gudea/v15/neIIzCqgsI0mp9gz25WPFqwKUQ.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
http://jedwatson.github.io/classnames	chromecache_210.2.dr, chromecache_302.2.dr, chromecache_226.2.dr, chromecache_296.2.dr	false	URL Reputation: safe	unknown
https://img1.wsimg.com/gfonts/s/gudea/v15/neILzCqgsI0mp9CNzoKmMw.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q-bHNiZg.woff2)	chromecache_200.2.dr, chromecache_201.2.dr, chromecache_219.2.dr	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521847
Start date and time:	2024-09-29 04:38:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://gemini_logip.godaddysites.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@20/219@26/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-in_corp_applications_base Browse: https://gemini_logip.godaddysites.com/services Browse: https://gemini_logip.godaddysites.com/faq Browse: https://gemini_logip.godaddysites.com/contact-us

Input	Output
URL: https://gemini_logip.godaddysites.com/ Model: jbxai	{ "brand":["Gemini"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Get started", "text_input_field_labels":["Market", "Create Alert"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://gemini_logip.godaddysites.com/services Model: jbxai	{ "brand":["gemini_logip"], "contains_trigger_text":false, "trigger_text":"unknown", "prominent_button_name":"ACCEPT", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://gemini_logip.godaddysites.com/faq Model: jbxai	{ "brand":["gemini_logip"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"ACCEPT", "text_input_field_labels":["This website uses cookies."], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://gemini_logip.godaddysites.com/contact-us Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":null, "prominent_button_name":"ACCEPT", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://gemini_logip.godaddysites.com/contact-us Model: jbxai	{ "brand":["GoDaddy"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"ACCEPT", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-in_corp_applications_base Model: jbxai	"{ \"brand\": [\"Godaddy\"], \"contains_trigger_text\": true, \"trigger_text\": \"You don't have permission to access \\\\\"http://www.godaddy.com/websites/website-builder?\\\\\" on this server.\", \"prominent_button_name\": \"unknown\", \"text_input_field_labels\": \"unknown\", \"pdf_icon_visible\": false, \"has_visible_captcha\": false, \"has_urgent_text\": false } "

URL: https://gemini_logip.godaddysites.com/contact-us Model: jbxai	{ "brand":["GoDaddy"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Start for Free", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 01:39:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.973810449090369
Encrypted:	false
SSDEEP:	48:8YdcTg4AAHRidAKZdA19ehwiZUklqehRy+3:8bHX+y
MD5:	18A649846E04D28670B85D2EC49A2D1E
SHA1:	961962523D8A4C35E246C3A84703A734F9CFFAA5
SHA-256:	0E63DC35435C81E2F4EEAF010B991A8E2D078EF7B495A2C390A454C19199DE94
SHA-512:	82FD8FB5CC480E3D1A4DB72E99666E40C0CF18E6D90059CC43453B241EE149E3AB59FE1690510C2E7E882BCF31C9D3F638AA1AF4E272A6A78EBF6B3982947195
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....st .....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I=Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V=Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V=Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V=Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V=Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h^.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 04:39:38.657887936 CEST	53	51731	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:38.676336050 CEST	53	56470	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:39.773629904 CEST	53	55211	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:40.246129990 CEST	56781	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:40.246280909 CEST	62535	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:40.254338980 CEST	53	62535	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:40.254914999 CEST	53	56781	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:40.962177992 CEST	54694	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:40.962881088 CEST	53	62078	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:40.964899063 CEST	52250	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:40.968385935 CEST	53352	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:40.968585014 CEST	54263	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:40.976645947 CEST	53	54263	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:40.976787090 CEST	53	53352	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:42.441904068 CEST	54543	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:42.442441940 CEST	50256	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:42.744329929 CEST	49245	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:42.744811058 CEST	55831	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:42.751260996 CEST	53	49245	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:42.751271963 CEST	53	55831	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:49.242887020 CEST	53576	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:49.243295908 CEST	49484	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:49.460731983 CEST	62595	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:49.461432934 CEST	56099	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:50.501456022 CEST	49617	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:50.501662016 CEST	56068	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:50.509552002 CEST	53	56068	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:50.510919094 CEST	53	49617	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:50.538825989 CEST	62359	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:50.539009094 CEST	59537	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:50.551084042 CEST	53	59537	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:50.551913023 CEST	53	62359	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:50.569027901 CEST	59161	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:50.569247007 CEST	60666	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:51.718447924 CEST	54037	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:51.718806982 CEST	60657	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:51.725747108 CEST	53	60657	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:51.730946064 CEST	53	54037	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:53.186207056 CEST	50502	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:53.186608076 CEST	50591	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:57.065680027 CEST	53	53179	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:57.233946085 CEST	64171	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:57.234411001 CEST	62640	53	192.168.2.5	1.1.1.1
Sep 29, 2024 04:39:57.245270967 CEST	53	64171	1.1.1.1	192.168.2.5
Sep 29, 2024 04:39:57.245284081 CEST	53	62640	1.1.1.1	192.168.2.5
Sep 29, 2024 04:40:16.968512058 CEST	53	53024	1.1.1.1	192.168.2.5
Sep 29, 2024 04:40:38.501727104 CEST	53	52370	1.1.1.1	192.168.2.5
Sep 29, 2024 04:40:39.936244965 CEST	53	54658	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:40 UTC	672	OUT	GET / HTTP/1.1 Host: gemini_logip.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:39:40 UTC	1362	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.1.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neILzCqgsI0mp9CNzoKmMw.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neIFzCqgsI0mp9CI_oA.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neIIzCqgsI0mp9gz25WBFqw.woff2>; rel=preload; as=font; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 4aa2609e65fb274ee9d2f0f4dd8a85cc Date: Sun, 29 Sep 2024 02:39:40 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 02:39:40 UTC	15022	IN	Data Raw: 64 35 32 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 64 39 62 62 66 36 63 64 2d 66 32 65 39 2d 34 64 37 38 2d 62 32 62 31 2d 30 37 32 35 63 33 30 33 31 32 65 33 2f 66 61 76 69 63 6f 6e 2f 36 35 39 66 37 36 62 64 2d 37 31 38 61 2d 34 37 30 34 2d 61 34 34 30 2d 34 62 30 61 34 30 62 34 38 37 32 38 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f Data Ascii: d52b<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/favicon/659f76bd-718a-4704-a440-4b0a40b48728.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/
2024-09-29 02:39:40 UTC	16384	IN	Data Raw: 49 43 45 4e 53 45 20 56 65 72 73 69 6f 6e 20 31 2e 31 20 2d 20 32 36 20 46 65 62 72 75 61 72 79 20 32 30 30 37 0a e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 2d 0a 2a 2f 0a 0a 2f 2a 0a 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 32 2c 20 41 67 75 73 74 69 6e 61 20 4d 69 6e 67 6f 74 65 20 28 61 67 75 73 74 69 6e 61 6d 69 6e 67 6f 74 65 40 67 6d 61 69 6c 2e 63 6f 6d 29 2c 20 77 69 74 68 20 52 65 73 65 72 76 65 64 20 46 6f 6e 74 20 4e 61 6d 65 73 20 22 47 75 64 65 61 22 0a 0a 54 68 69 73 20 46 6f 6e 74 20 53 6f 66 74 77 61 72 65 20 69 73 Data Ascii: ICENSE Version 1.1 - 26 February 2007-//Copyright (c) 2012, Agustina Mingote (agustinamingote@gmail.com), with Reserved Font Names "Gudea"This Font Software is
2024-09-29 02:39:40 UTC	16384	IN	Data Raw: 3d 22 42 6c 6f 63 6b 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 32 73 20 63 31 2d 31 33 20 63 31 2d 32 74 20 63 31 2d 31 35 20 63 31 2d 75 20 63 31 2d 76 20 63 31 2d 32 75 20 63 31 2d 32 76 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 6e 61 76 20 64 61 74 61 2d 75 78 3d 22 4e 61 76 22 20 64 61 74 61 2d 61 69 64 3d 22 48 45 41 44 45 52 5f 4e 41 56 5f 52 45 4e 44 45 52 45 44 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 6e 61 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 73 20 63 31 2d 32 77 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d Data Ascii: ="Block" class="x-el x-el-div c1-1 c1-2 c1-2s c1-13 c1-2t c1-15 c1-u c1-v c1-2u c1-2v c1-b c1-c c1-d c1-e c1-f c1-g"><nav data-ux="Nav" data-aid="HEADER_NAV_RENDERED" role="navigation" class="x-el x-el-nav c1-1 c1-2 c1-s c1-2w c1-b c1-c c1-d c1-e c1-f c1-
2024-09-29 02:39:41 UTC	6794	IN	Data Raw: 74 68 3a 20 31 30 32 34 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 37 39 70 78 29 22 20 73 72 63 53 65 74 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 64 39 62 62 66 36 63 64 2d 66 32 65 39 2d 34 64 37 38 2d 62 32 62 31 2d 30 37 32 35 63 33 30 33 31 32 65 33 2f 67 65 6d 69 6e 69 2d 6c 6f 67 69 6e 2d 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 39 38 34 2c 68 3a 34 36 37 22 2f 3e 3c 73 6f 75 72 63 65 20 6d 65 64 69 61 3d 22 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 38 30 70 78 29 22 20 73 72 63 53 65 74 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 64 39 62 62 66 36 63 64 2d 66 32 65 39 2d 34 64 37 38 2d 62 32 62 31 2d 30 37 32 35 63 33 30 33 31 32 65 33 2f 67 Data Ascii: th: 1024px) and (max-width: 1279px)" srcSet="//img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/gemini-login-.png/:/rs=w:984,h:467"/><source media="(min-width: 1280px)" srcSet="//img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/g

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:44 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 02:39:44 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=137118 Date: Sun, 29 Sep 2024 02:39:44 GMT Connection: close X-CID: 2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://gemini_logip.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Windows Analysis Report
https://gemini_logip.godaddysites.com/

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:45 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-29 02:39:46 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=137147 Date: Sun, 29 Sep 2024 02:39:45 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-29 02:39:46 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:49 UTC	664	OUT	GET /sw.js HTTP/1.1 Host: gemini_logip.godaddysites.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://gemini_logip.godaddysites.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
2024-09-29 02:39:49 UTC	663	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/javascript Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: 4c26bd2f89896c19bab99604434afdbc Date: Sun, 29 Sep 2024 02:39:49 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 02:39:49 UTC	15721	IN	Data Raw: 38 30 64 33 0d 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 38 39 35 3a 28 29 3d 3e 7b 74 72 79 7b 73 65 6c 66 5b 22 77 6f 72 6b 62 6f 78 3a 63 61 63 68 65 61 62 6c 65 2d 72 65 73 70 6f 6e 73 65 3a 36 2e 34 2e 31 22 5d 26 26 5f 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 32 35 39 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 42 3a 28 29 3d 3e 61 7d 29 2c 73 28 39 31 33 29 3b 63 6c 61 73 73 20 61 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 70 72 6f 6d 69 73 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 28 65 2c 74 29 3d 3e 7b 74 68 69 73 2e 72 65 73 6f 6c 76 65 3d 65 2c 74 68 69 73 2e 72 65 6a 65 63 74 3d 74 7d 29 29 7d 7d 7d 2c 31 32 35 3a 28 65 2c 74 2c 73 29 3d 3e 7b 73 2e 64 28 74 2c 7b 56 3a Data Ascii: 80d3(()=>{"use strict";var e={895:()=>{try{self["workbox:cacheable-response:6.4.1"]&&_()}catch(e){}},259:(e,t,s)=>{s.d(t,{B:()=>a}),s(913);class a{constructor(){this.promise=new Promise(((e,t)=>{this.resolve=e,this.reject=t}))}}},125:(e,t,s)=>{s.d(t,{V:
2024-09-29 02:39:49 UTC	16384	IN	Data Raw: 65 2c 74 29 7c 7c 52 2e 68 61 73 28 65 2c 74 29 7d 2c 73 28 35 35 30 29 3b 63 6f 6e 73 74 20 76 3d 22 63 61 63 68 65 2d 65 6e 74 72 69 65 73 22 2c 62 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 52 4c 28 65 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 72 65 74 75 72 6e 20 74 2e 68 61 73 68 3d 22 22 2c 74 2e 68 72 65 66 7d 3b 63 6c 61 73 73 20 78 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 73 2e 5f 64 62 3d 6e 75 6c 6c 2c 74 68 69 73 2e 5f 63 61 63 68 65 4e 61 6d 65 3d 65 7d 5f 75 70 67 72 61 64 65 44 62 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 63 72 65 61 74 65 4f 62 6a 65 63 74 53 74 6f 72 65 28 76 2c 7b 6b 65 79 50 61 74 68 3a 22 69 64 22 7d 29 3b 74 2e 63 72 65 61 74 65 49 6e 64 65 78 28 22 63 61 63 68 65 4e 61 6d 65 22 2c 22 Data Ascii: e,t)\|\|R.has(e,t)},s(550);const v="cache-entries",b=e=>{const t=new URL(e,location.href);return t.hash="",t.href};class x{constructor(e){this._db=null,this._cacheName=e}_upgradeDb(e){const t=e.createObjectStore(v,{keyPath:"id"});t.createIndex("cacheName","
2024-09-29 02:39:49 UTC	887	IN	Data Raw: 29 29 2c 28 30 2c 65 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 29 28 28 28 7b 72 65 71 75 65 73 74 3a 65 7d 29 3d 3e 22 73 74 79 6c 65 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 7c 7c 22 73 63 72 69 70 74 22 3d 3d 3d 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 29 2c 6e 65 77 20 74 2e 53 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 28 7b 63 61 63 68 65 4e 61 6d 65 3a 22 73 74 61 74 69 63 2d 72 65 73 6f 75 72 63 65 73 22 2c 70 6c 75 67 69 6e 73 3a 5b 6e 65 77 20 61 2e 43 61 63 68 65 61 62 6c 65 52 65 73 70 6f 6e 73 65 50 6c 75 67 69 6e 28 7b 73 74 61 74 75 73 65 73 3a 5b 32 30 30 5d 7d 29 5d 7d 29 29 2c 28 30 2c 65 2e 72 65 67 69 73 74 65 72 52 6f 75 74 65 29 28 28 28 7b 75 72 6c 3a 65 7d 29 3d 3e 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e Data Ascii: )),(0,e.registerRoute)((({request:e})=>"style"===e.destination\|\|"script"===e.destination),new t.StaleWhileRevalidate({cacheName:"static-resources",plugins:[new a.CacheableResponsePlugin({statuses:[200]})]})),(0,e.registerRoute)((({url:e})=>"https://fonts.

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:49 UTC	733	OUT	GET /markup/ad HTTP/1.1 Host: gemini_logip.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gemini_logip.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
2024-09-29 02:39:50 UTC	655	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html; charset=utf-8 Pragma: no-cache Expires: 0 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Sun, 29 Sep 2024 02:39:50 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 02:39:50 UTC	7275	IN	Data Raw: 31 63 35 65 0d 0a 3c 64 69 76 20 69 64 3d 22 47 4f 44 41 44 44 59 5f 46 52 45 45 4d 49 55 4d 5f 41 44 22 20 63 6c 61 73 73 3d 22 67 64 2d 61 64 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 47 44 20 53 68 65 72 70 61 22 3b 0a 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 62 6c 6f 62 62 79 2f 67 6f 2f 75 78 2f 66 6f 6e 74 73 2f 73 68 65 72 70 61 2f 31 2e 31 2f 67 64 73 68 65 72 70 61 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 32 27 29 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 0a 20 20 20 20 7d 0a Data Ascii: 1c5e<div id="GODADDY_FREEMIUM_AD" class="gd-ad-wrapper"> <style type="text/css"> @font-face { font-family: "GD Sherpa"; src: url('//img1.wsimg.com/blobby/go/ux/fonts/sherpa/1.1/gdsherpa-regular.woff2'); font-display: swap; }

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:50 UTC	645	OUT	GET /faq HTTP/1.1 Host: gemini_logip.godaddysites.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gemini_logip.godaddysites.com/sw.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
2024-09-29 02:39:50 UTC	1362	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.1.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neILzCqgsI0mp9CNzoKmMw.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neIFzCqgsI0mp9CI_oA.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neIIzCqgsI0mp9gz25WBFqw.woff2>; rel=preload; as=font; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: a4bb9621243a4bc94108cd3dec54efc8 Date: Sun, 29 Sep 2024 02:39:50 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 02:39:50 UTC	15022	IN	Data Raw: 31 30 66 38 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 64 39 62 62 66 36 63 64 2d 66 32 65 39 2d 34 64 37 38 2d 62 32 62 31 2d 30 37 32 35 63 33 30 33 31 32 65 33 2f 66 61 76 69 63 6f 6e 2f 36 35 39 66 37 36 62 64 2d 37 31 38 61 2d 34 37 30 34 2d 61 34 34 30 2d 34 62 30 61 34 30 62 34 38 37 32 38 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d Data Ascii: 10f8b<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/favicon/659f76bd-718a-4704-a440-4b0a40b48728.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com
2024-09-29 02:39:51 UTC	16384	IN	Data Raw: e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 2d 0a 2a 2f 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 73 74 79 6c 65 20 64 61 74 61 2d 67 6c 61 6d 6f 72 3d 22 63 78 73 2d 64 65 66 61 75 6c 74 2d 73 68 65 65 74 22 3e 2e 78 20 2e 63 31 2d 31 7b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 6e 6f 72 6d 61 6c 7d 2e 78 20 2e 63 31 2d 32 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 2e 78 20 2e 63 31 2d 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 29 7d 2e 78 20 2e 63 31 2d 34 7b 77 69 64 74 68 3a 31 30 30 25 7d 2e 78 20 2e 63 31 2d 35 20 3e 20 64 69 76 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 Data Ascii: -*/</style><style data-glamor="cxs-default-sheet">.x .c1-1{letter-spacing:normal}.x .c1-2{text-transform:none}.x .c1-3{background-color:rgb(255, 255, 255)}.x .c1-4{width:100%}.x .c1-5 > div{position:re
2024-09-29 02:39:51 UTC	16384	IN	Data Raw: 34 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 7b 2e 78 20 2e 63 31 2d 35 74 7b 77 69 64 74 68 3a 31 30 30 25 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 30 32 33 70 78 29 7b 2e 78 20 2e 63 31 2d 38 78 7b 6f 72 64 65 72 3a 2d 31 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 30 32 33 70 78 29 7b 2e 78 20 2e 63 31 2d 39 76 7b 68 65 69 67 68 74 3a 34 34 38 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 7b 2e 78 20 2e 63 31 2d 62 31 7b 77 69 64 74 68 3a 34 30 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d Data Ascii: 4px}}@media (min-width: 768px){.x .c1-5t{width:100%}}@media (min-width: 768px) and (max-width: 1023px){.x .c1-8x{order:-1}}@media (min-width: 768px) and (max-width: 1023px){.x .c1-9v{height:448px}}@media (min-width: 768px){.x .c1-b1{width:400px}}@media (m
2024-09-29 02:39:51 UTC	16384	IN	Data Raw: 31 2d 63 20 63 31 2d 34 65 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 61 20 72 65 6c 3d 22 22 20 72 6f 6c 65 3d 22 6c 69 6e 6b 22 20 61 72 69 61 2d 68 61 73 70 6f 70 75 70 3d 22 66 61 6c 73 65 22 20 64 61 74 61 2d 75 78 3d 22 4e 61 76 4d 6f 72 65 4d 65 6e 75 4c 69 6e 6b 41 63 74 69 76 65 22 20 74 61 72 67 65 74 3d 22 22 20 64 61 74 61 2d 70 61 67 65 3d 22 35 63 66 37 39 39 62 38 2d 66 37 37 61 2d 34 63 66 31 2d 39 62 63 35 2d 38 33 32 35 63 31 34 39 61 32 35 32 22 20 64 61 74 61 2d 65 64 69 74 2d 69 6e 74 65 72 61 63 74 69 76 65 3d 22 74 72 75 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 6c 65 64 62 79 3d 22 6d 6f 72 65 2d 34 37 37 38 38 22 20 68 72 65 66 3d 22 2f 66 61 71 22 20 64 61 74 61 2d 74 79 70 6f 67 72 61 70 68 79 3d 22 4e 61 Data Ascii: 1-c c1-4e c1-d c1-e c1-f c1-g"><a rel="" role="link" aria-haspopup="false" data-ux="NavMoreMenuLinkActive" target="" data-page="5cf799b8-f77a-4cf1-9bc5-8325c149a252" data-edit-interactive="true" aria-labelledby="more-47788" href="/faq" data-typography="Na
2024-09-29 02:39:51 UTC	5355	IN	Data Raw: 65 6c 20 78 2d 65 6c 2d 68 72 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 61 6f 20 63 31 2d 37 78 20 63 31 2d 33 78 20 63 31 2d 32 33 20 63 31 2d 77 20 63 31 2d 34 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 2f 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 64 61 74 61 2d 75 78 3d 22 43 6f 6e 74 61 69 6e 65 72 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 6f 20 63 31 2d 70 20 63 31 2d 71 20 63 31 2d 72 20 63 31 2d 73 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 35 74 20 63 31 2d 64 20 63 31 2d 35 75 20 63 31 2d 65 20 63 31 2d 35 76 20 63 31 2d 66 20 63 31 2d 35 77 20 63 31 2d 67 22 3e 3c 64 69 76 20 64 61 74 61 2d 75 78 3d 22 4c 61 79 6f 75 74 Data Ascii: el x-el-hr c1-1 c1-2 c1-ao c1-7x c1-3x c1-23 c1-w c1-4 c1-b c1-c c1-d c1-e c1-f c1-g"/></div></div><div data-ux="Container" class="x-el x-el-div c1-1 c1-2 c1-o c1-p c1-q c1-r c1-s c1-b c1-c c1-5t c1-d c1-5u c1-e c1-5v c1-f c1-5w c1-g"><div data-ux="Layout

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:51 UTC	1423	OUT	GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjE2ZjcxYzY1MzZkZjRmMjA4MmNlODFkMjYyYzM4OWUyIiwiZGoiOjAsImlpIjoiN2Q2N2NhNTQ1YjAxNDAxMGFkNDY0MmNmMzY5YzMwMTMiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyMDA5MjAwLCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtYTIyNmU2NjQwMWU4NDFkOGI1NzE5OGRjZmRjYmYyMjEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzU5MDM2MCwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=O0ZB0yHIDrTqQ88Kx_Fc-320MxQ&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21 HTTP/1.1 Host: ms.godaddy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gemini_logip.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:39:51 UTC	796	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 02:39:51 GMT Content-Type: image/gif Content-Length: 43 Connection: close Access-Control-Allow-Origin: undefined Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Headers: Accept, Origin, Content-Type, Content-Length, X-Adzerk-Explain, X-Adzerk-Sdk-Version Cache-Control: no-cache, no-store, must-revalidate Expires: 0 Pragma: no-cache x-served-by: prod-eventservers-shard102-eu-west-1-01-i-0ae4ca80b9515194b Set-Cookie: azk=ue1-a226e66401e841d8b57198dcfdcbf221; Path=/; Expires=Mon, 29 Sep 2025 02:39:51 GMT; Secure; SameSite=None Set-Cookie: azk-ss=true; Path=/; Expires=Mon, 29 Sep 2025 02:39:51 GMT; Secure; SameSite=None ETag: W/"2b-6KwiS6nul+h2cO1vOi8BKLevn+Q"
2024-09-29 02:39:51 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:51 UTC	652	OUT	GET /contact-us HTTP/1.1 Host: gemini_logip.godaddysites.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gemini_logip.godaddysites.com/sw.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
2024-09-29 02:39:51 UTC	1362	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.1.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neILzCqgsI0mp9CNzoKmMw.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neIFzCqgsI0mp9CI_oA.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/gudea/v15/neIIzCqgsI0mp9gz25WBFqw.woff2>; rel=preload; as=font; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: d668ba31d604897bd42bfb02b493564c Date: Sun, 29 Sep 2024 02:39:51 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 02:39:51 UTC	15022	IN	Data Raw: 65 33 63 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 64 39 62 62 66 36 63 64 2d 66 32 65 39 2d 34 64 37 38 2d 62 32 62 31 2d 30 37 32 35 63 33 30 33 31 32 65 33 2f 66 61 76 69 63 6f 6e 2f 36 35 39 66 37 36 62 64 2d 37 31 38 61 2d 34 37 30 34 2d 61 34 34 30 2d 34 62 30 61 34 30 62 34 38 37 32 38 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f Data Ascii: e3cb<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/favicon/659f76bd-718a-4704-a440-4b0a40b48728.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/
2024-09-29 02:39:51 UTC	16384	IN	Data Raw: e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 e2 80 94 2d 0a 2a 2f 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 73 74 79 6c 65 20 64 61 74 61 2d 67 6c 61 6d 6f 72 3d 22 63 78 73 2d 64 65 66 61 75 6c 74 2d 73 68 65 65 74 22 3e 2e 78 20 2e 63 31 2d 31 7b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 6e 6f 72 6d 61 6c 7d 2e 78 20 2e 63 31 2d 32 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 2e 78 20 2e 63 31 2d 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 29 7d 2e 78 20 2e 63 31 2d 34 7b 77 69 64 74 68 3a 31 30 30 25 7d 2e 78 20 2e 63 31 2d 35 20 3e 20 64 69 76 7b 70 6f 73 69 74 Data Ascii: -*/</style><style data-glamor="cxs-default-sheet">.x .c1-1{letter-spacing:normal}.x .c1-2{text-transform:none}.x .c1-3{background-color:rgb(255, 255, 255)}.x .c1-4{width:100%}.x .c1-5 > div{posit
2024-09-29 02:39:51 UTC	16384	IN	Data Raw: 20 63 31 2d 32 32 20 63 31 2d 32 33 20 63 31 2d 77 20 63 31 2d 73 20 63 31 2d 31 66 20 63 31 2d 31 67 20 63 31 2d 32 34 20 63 31 2d 32 35 20 63 31 2d 32 36 20 63 31 2d 32 37 20 63 31 2d 32 38 20 63 31 2d 32 39 20 63 31 2d 32 61 22 3e 67 65 6d 69 6e 69 5f 6c 6f 67 69 70 3c 2f 68 33 3e 3c 73 70 61 6e 20 72 6f 6c 65 3d 22 68 65 61 64 69 6e 67 22 20 61 72 69 61 2d 6c 65 76 65 6c 3d 22 4e 61 4e 22 20 64 61 74 61 2d 75 78 3d 22 73 63 61 6c 65 72 22 20 64 61 74 61 2d 73 69 7a 65 3d 22 78 78 6c 61 72 67 65 22 20 64 61 74 61 2d 73 63 61 6c 65 72 2d 69 64 3d 22 73 63 61 6c 65 72 2d 6c 6f 67 6f 2d 63 6f 6e 74 61 69 6e 65 72 2d 33 32 36 32 32 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 20 64 61 74 61 2d 74 79 70 6f 67 72 61 70 68 79 3d 22 4c 6f 67 6f Data Ascii: c1-22 c1-23 c1-w c1-s c1-1f c1-1g c1-24 c1-25 c1-26 c1-27 c1-28 c1-29 c1-2a">gemini_logip</h3><span role="heading" aria-level="NaN" data-ux="scaler" data-size="xxlarge" data-scaler-id="scaler-logo-container-32622" aria-hidden="true" data-typography="Logo
2024-09-29 02:39:51 UTC	10538	IN	Data Raw: 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 64 69 76 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 33 65 20 63 31 2d 64 20 63 31 2d 34 69 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 6e 61 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 73 65 63 74 69 6f 6e 3e 20 20 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 31 39 34 30 66 31 31 35 2d 63 64 39 65 2d 34 64 65 38 2d 61 64 37 66 2d 38 31 36 37 62 36 37 62 64 34 34 61 22 20 63 6c 61 73 73 3d 22 77 69 64 67 65 74 20 77 69 64 67 65 74 2d 63 6f 6e 74 61 63 74 20 77 69 64 67 65 74 2d 63 6f 6e Data Ascii: lass="x-el x-el-div c1-1 c1-2 c1-b c1-c c1-3e c1-d c1-4i c1-e c1-f c1-g"></div></div></div></div></div></div></nav></div></div></div></div></section> </div></div></div><div id="1940f115-cd9e-4de8-ad7f-8167b67bd44a" class="widget widget-contact widget-con

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:52 UTC	562	OUT	GET /manifest.webmanifest HTTP/1.1 Host: gemini_logip.godaddysites.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://gemini_logip.godaddysites.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-29 02:39:52 UTC	666	IN	HTTP/1.1 200 OK Link: <https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: application/manifest+json Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: a6d54152bed989f616129f2cbc6bc766 Date: Sun, 29 Sep 2024 02:39:52 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 02:39:52 UTC	535	IN	Data Raw: 32 30 62 0d 0a 7b 22 73 63 6f 70 65 22 3a 22 2f 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 2f 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 22 69 63 6f 6e 73 22 3a 5b 7b 22 73 69 7a 65 73 22 3a 22 31 39 32 78 31 39 32 22 2c 22 74 79 70 65 22 3a 22 69 6d 61 67 65 2f 70 6e 67 22 2c 22 73 72 63 22 3a 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 64 39 62 62 66 36 63 64 2d 66 32 65 39 2d 34 64 37 38 2d 62 32 62 31 2d 30 37 32 35 63 33 30 33 31 32 65 33 2f 66 61 76 69 63 6f 6e 2f 36 35 39 66 37 36 62 64 2d 37 31 38 61 2d 34 37 30 34 2d 61 34 34 30 2d 34 62 30 61 34 30 62 34 38 37 32 38 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 39 32 2c 68 3a 31 39 32 2c 6d 22 7d 2c 7b 22 73 69 7a 65 73 22 3a 22 Data Ascii: 20b{"scope":"/","start_url":"/","display":"standalone","icons":[{"sizes":"192x192","type":"image/png","src":"//img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/favicon/659f76bd-718a-4704-a440-4b0a40b48728.png/:/rs=w:192,h:192,m"},{"sizes":"

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:52 UTC	1237	OUT	GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjE2ZjcxYzY1MzZkZjRmMjA4MmNlODFkMjYyYzM4OWUyIiwiZGoiOjAsImlpIjoiN2Q2N2NhNTQ1YjAxNDAxMGFkNDY0MmNmMzY5YzMwMTMiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wYjQ5OTg3NDE5ODVjNWJmNiIsInNwIjoyMDA5MjAwLCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtYTIyNmU2NjQwMWU4NDFkOGI1NzE5OGRjZmRjYmYyMjEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU3NzU5MDM2MCwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=O0ZB0yHIDrTqQ88Kx_Fc-320MxQ&publisher_website_key=wam.md5.56a3c9444b6520a43a69f42d57ec8d21 HTTP/1.1 Host: ms.godaddy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: azk=ue1-a226e66401e841d8b57198dcfdcbf221; azk-ss=true
2024-09-29 02:39:52 UTC	701	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 02:39:52 GMT Content-Type: image/gif Content-Length: 43 Connection: close Access-Control-Allow-Origin: undefined Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Headers: Accept, Origin, Content-Type, Content-Length, X-Adzerk-Explain, X-Adzerk-Sdk-Version Cache-Control: no-cache, no-store, must-revalidate Expires: 0 Pragma: no-cache x-served-by: prod-eventservers-shard102-eu-west-1-01-i-0eca2297cc1208e0f Set-Cookie: azk=ue1-a226e66401e841d8b57198dcfdcbf221; Path=/; Expires=Mon, 29 Sep 2025 02:39:52 GMT; Secure; SameSite=None ETag: W/"2b-6KwiS6nul+h2cO1vOi8BKLevn+Q"
2024-09-29 02:39:52 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:52 UTC	650	OUT	GET /services HTTP/1.1 Host: gemini_logip.godaddysites.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gemini_logip.godaddysites.com/sw.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: dps_site_id=us-east-1; _tccl_visitor=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _tccl_visit=3dcb6b06-e37c-4744-9af4-bf62d9d11f80; _scc_session=pc=1&C_TOUCH=2024-09-29T02:39:44.130Z
2024-09-29 02:39:52 UTC	844	IN	HTTP/1.1 200 OK Link: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.1.js>; rel=preload; as=script; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossorigin,<https://api.ola.godaddy.com>; rel=preconnect; crossorigin Cache-Control: max-age=30 Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.com Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding Server: DPS/2.0.0+sha-227ca78 X-Version: 227ca78 X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure ETag: cdbc5fe8bad0009df18e2b5956d0d970 Date: Sun, 29 Sep 2024 02:39:52 GMT Connection: close Transfer-Encoding: chunked
2024-09-29 02:39:52 UTC	15540	IN	Data Raw: 65 36 61 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 49 4e 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 69 73 74 65 61 6d 2f 69 70 2f 64 39 62 62 66 36 63 64 2d 66 32 65 39 2d 34 64 37 38 2d 62 32 62 31 2d 30 37 32 35 63 33 30 33 31 32 65 33 2f 66 61 76 69 63 6f 6e 2f 36 35 39 66 37 36 62 64 2d 37 31 38 61 2d 34 37 30 34 2d 61 34 34 30 2d 34 62 30 61 34 30 62 34 38 37 32 38 2e 70 6e 67 2f 3a 2f 72 73 3d 77 3a 31 36 2c 68 3a 31 36 2c 6d 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f Data Ascii: e6a6<!DOCTYPE html><html lang="en-IN"><head><link rel="icon" href="//img1.wsimg.com/isteam/ip/d9bbf6cd-f2e9-4d78-b2b1-0725c30312e3/favicon/659f76bd-718a-4704-a440-4b0a40b48728.png/:/rs=w:16,h:16,m" sizes="16x16"/><link rel="icon" href="//img1.wsimg.com/
2024-09-29 02:39:52 UTC	16384	IN	Data Raw: 37 33 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 32 70 78 7d 2e 78 20 2e 63 31 2d 37 38 20 3e 20 2a 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 78 20 2e 63 31 2d 37 39 20 3e 20 3a 6e 74 68 2d 63 68 69 6c 64 28 6e 29 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 34 70 78 7d 2e 78 20 2e 63 31 2d 37 61 20 20 3e 20 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 78 20 2e 63 31 2d 37 64 7b 6f 72 64 65 72 3a 2d 31 7d 2e 78 20 2e 63 31 2d 37 65 7b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 78 20 2e 63 31 2d 37 66 7b 61 73 70 65 63 74 2d 72 61 74 69 6f 3a 31 20 2f 20 31 7d 2e 78 20 2e 63 31 2d 37 67 7b 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 7d 2e 78 20 2e 63 31 2d 37 69 20 3e 20 3a Data Ascii: 73{padding-left:12px}.x .c1-78 > *{max-width:100%}.x .c1-79 > :nth-child(n){margin-bottom:24px}.x .c1-7a > :last-child{margin-bottom:0 !important}.x .c1-7d{order:-1}.x .c1-7e{z-index:1}.x .c1-7f{aspect-ratio:1 / 1}.x .c1-7g{object-fit:cover}.x .c1-7i > :
2024-09-29 02:39:52 UTC	16384	IN	Data Raw: 32 36 20 63 31 2d 31 79 20 63 31 2d 33 6f 20 63 31 2d 33 70 20 63 31 2d 33 71 20 63 31 2d 33 72 20 63 31 2d 33 73 22 20 64 61 74 61 2d 74 63 63 6c 3d 22 75 78 32 2e 48 45 41 44 45 52 2e 68 65 61 64 65 72 39 2e 4e 61 76 2e 4d 6f 72 65 4d 65 6e 75 2e 4c 69 6e 6b 2e 44 65 66 61 75 6c 74 2e 34 38 37 30 34 2e 63 6c 69 63 6b 2c 63 6c 69 63 6b 22 3e 48 6f 6d 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 64 61 74 61 2d 75 78 3d 22 4c 69 73 74 49 74 65 6d 22 20 72 6f 6c 65 3d 22 6d 65 6e 75 69 74 65 6d 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 6c 69 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 33 34 20 63 31 2d 77 20 63 31 2d 33 65 20 63 31 2d 31 38 20 63 31 2d 62 20 63 31 2d 63 20 63 31 2d 34 65 20 63 31 2d 64 20 63 31 2d 65 20 63 31 2d 66 20 63 31 2d 67 Data Ascii: 26 c1-1y c1-3o c1-3p c1-3q c1-3r c1-3s" data-tccl="ux2.HEADER.header9.Nav.MoreMenu.Link.Default.48704.click,click">Home</a></li><li data-ux="ListItem" role="menuitem" class="x-el x-el-li c1-1 c1-2 c1-34 c1-w c1-3e c1-18 c1-b c1-c c1-4e c1-d c1-e c1-f c1-g
2024-09-29 02:39:52 UTC	10751	IN	Data Raw: 3d 22 68 65 61 64 69 6e 67 22 20 61 72 69 61 2d 6c 65 76 65 6c 3d 22 34 22 20 64 61 74 61 2d 75 78 3d 22 43 6f 6e 74 65 6e 74 43 61 72 64 48 65 61 64 69 6e 67 22 20 64 61 74 61 2d 74 79 70 6f 67 72 61 70 68 79 3d 22 48 65 61 64 69 6e 67 44 65 6c 74 61 22 20 63 6c 61 73 73 3d 22 78 2d 65 6c 20 78 2d 65 6c 2d 68 34 20 63 31 2d 31 20 63 31 2d 32 20 63 31 2d 31 6f 20 63 31 2d 31 70 20 63 31 2d 37 6c 20 63 31 2d 32 31 20 63 31 2d 32 32 20 63 31 2d 32 33 20 63 31 2d 37 71 20 63 31 2d 37 6d 20 63 31 2d 36 31 20 63 31 2d 37 6e 20 63 31 2d 76 20 63 31 2d 32 64 20 63 31 2d 32 65 20 63 31 2d 37 6f 20 63 31 2d 35 62 20 63 31 2d 62 20 63 31 2d 32 34 20 63 31 2d 32 6e 20 63 31 2d 32 36 20 63 31 2d 32 6f 20 63 31 2d 37 72 20 63 31 2d 32 70 20 63 31 2d 32 71 20 63 31 2d Data Ascii: ="heading" aria-level="4" data-ux="ContentCardHeading" data-typography="HeadingDelta" class="x-el x-el-h4 c1-1 c1-2 c1-1o c1-1p c1-7l c1-21 c1-22 c1-23 c1-7q c1-7m c1-61 c1-7n c1-v c1-2d c1-2e c1-7o c1-5b c1-b c1-24 c1-2n c1-26 c1-2o c1-7r c1-2p c1-2q c1-

Timestamp	Bytes transferred	Direction	Data
2024-09-29 02:39:54 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1727577561007&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-09-29 02:39:54 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-09-29 02:39:54 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-09-29 02:39:55 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 93CA7D59A2884369ACB01F61016ECF30 Ref B: LAX311000112045 Ref C: 2024-09-29T02:39:55Z Date: Sun, 29 Sep 2024 02:39:55 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.5fed0117.1727577595.1ab94a4d