# ==============================================================================
# CYNET CYBERNETIC INTELLIGENCE // SOC INCIDENT FORENSIC AUDIT DUMP
# TICKET: #IR-9042-SR // INCIDENT TYPE: ADVANCED PERSISTENT THREAT (APT) PROBE
# ENVIRONMENT: GATEWAY-REVERSE-PROXY-01.TEHRAN-EDGE (CLUSTER: CYN-IR-PROD)
# CAPTURE TIMEFRAME: 01/Nov/2026:20:45:00 +0000 TO 01/Nov/2026:21:18:00 +0000
# CLASSIFICATION: CYNET CTF DEFCON-2 // TLP:CLEAR // BLUE TEAM DFIR LAB
# SENSOR ID: CYN-SNORT-TEH-01 | WAF ENGINE: ModSecurity v3.0.12 (CRS 4.2)
# LOG FORMAT: Combined Log Format with SOC Event Telemetry Interleaving
# ==============================================================================

# --- SECTION 1: ROUTINE EDGE TELEMETRY & ACADEMY WEB TRAFFIC ---
37.255.142.66 - - [01/Nov/2026:20:45:01 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
188.253.11.84 - - [01/Nov/2026:20:45:13 +0000] "GET /api/auth.php HTTP/1.1" 200 140 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
94.182.176.5 - - [01/Nov/2026:20:45:25 +0000] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
37.255.142.66 - - [01/Nov/2026:20:45:36 +0000] "GET /favicon.ico HTTP/1.1" 200 4286 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
78.38.112.90 - - [01/Nov/2026:20:45:50 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
78.38.112.90 - - [01/Nov/2026:20:46:00 +0000] "GET /roadmap HTTP/1.1" 200 28400 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
188.253.11.84 - - [01/Nov/2026:20:46:08 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:20:46:19 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
158.58.172.44 - - [01/Nov/2026:20:46:26 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
91.92.241.10 - - [01/Nov/2026:20:46:35 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:46:42 +0000] "GET /roadmap HTTP/1.1" 200 28400 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
31.56.128.91 - - [01/Nov/2026:20:46:51 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
66.249.66.45 - - [01/Nov/2026:20:46:12 +0000] "GET /robots.txt HTTP/1.1" 200 320 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"
66.249.66.45 - - [01/Nov/2026:20:46:14 +0000] "GET /sitemap.xml HTTP/1.1" 200 1850 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"
194.225.24.5 - - [01/Nov/2026:20:47:00 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
5.112.64.129 - - [01/Nov/2026:20:47:09 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
5.160.198.42 - - [01/Nov/2026:20:47:18 +0000] "GET /dashboard HTTP/1.1" 200 52300 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:47:26 +0000] "GET /assets/images/osint-banner.jpg HTTP/1.1" 200 184500 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
78.38.112.90 - - [01/Nov/2026:20:47:36 +0000] "GET /assets/images/forensics-banner.jpg HTTP/1.1" 200 192300 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
185.143.232.18 - - [01/Nov/2026:20:47:44 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
5.112.64.129 - - [01/Nov/2026:20:47:51 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
80.191.218.15 - - [01/Nov/2026:20:48:02 +0000] "GET /assets/images/osint-banner.jpg HTTP/1.1" 200 184500 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
188.253.11.84 - - [01/Nov/2026:20:48:08 +0000] "GET /assets/images/kali-redteam-banner.jpg HTTP/1.1" 200 210400 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
94.182.176.5 - - [01/Nov/2026:20:48:15 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
5.112.64.129 - - [01/Nov/2026:20:48:23 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
46.225.241.77 - - [01/Nov/2026:20:48:30 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:48:37 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:48:46 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
188.253.11.84 - - [01/Nov/2026:20:48:52 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
185.165.116.3 - - [01/Nov/2026:20:49:00 +0000] "GET /course-osint HTTP/1.1" 200 35400 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
89.199.34.12 - - [01/Nov/2026:20:49:07 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
46.225.241.77 - - [01/Nov/2026:20:49:17 +0000] "GET /ctf HTTP/1.1" 200 45200 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
5.112.64.129 - - [01/Nov/2026:20:49:23 +0000] "GET /course-kali-redteam HTTP/1.1" 200 41200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
91.108.182.50 - - [01/Nov/2026:20:49:30 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
178.22.122.100 - - [01/Nov/2026:20:49:38 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
37.255.142.66 - - [01/Nov/2026:20:49:47 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:20:49:52 +0000] "GET /api/auth.php HTTP/1.1" 200 140 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:20:50:02 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
194.225.24.5 - - [01/Nov/2026:20:50:12 +0000] "GET /dashboard HTTP/1.1" 200 52300 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
188.253.11.84 - - [01/Nov/2026:20:50:24 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
94.182.176.5 - - [01/Nov/2026:20:50:37 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
185.143.232.18 - - [01/Nov/2026:20:50:48 +0000] "GET /course-osint HTTP/1.1" 200 35400 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
91.108.182.50 - - [01/Nov/2026:20:51:00 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
37.255.142.66 - - [01/Nov/2026:20:51:08 +0000] "GET /course-kali-redteam HTTP/1.1" 200 41200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
5.112.64.129 - - [01/Nov/2026:20:51:17 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
89.199.34.12 - - [01/Nov/2026:20:51:27 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
158.58.172.44 - - [01/Nov/2026:20:51:35 +0000] "GET /assets/images/osint-banner.jpg HTTP/1.1" 200 184500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
31.56.128.91 - - [01/Nov/2026:20:51:43 +0000] "GET /course-kali-redteam HTTP/1.1" 200 41200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:51:52 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
40.77.167.33 - - [01/Nov/2026:20:51:30 +0000] "GET /course-osint HTTP/1.1" 200 35400 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
40.77.167.33 - - [01/Nov/2026:20:51:32 +0000] "GET /roadmap HTTP/1.1" 200 28400 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
185.191.171.12 - - [01/Nov/2026:20:52:00 +0000] "GET /assets/images/osint-banner.jpg HTTP/1.1" 200 184500 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
89.199.34.12 - - [01/Nov/2026:20:52:08 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
151.246.88.19 - - [01/Nov/2026:20:52:17 +0000] "GET /course-kali-redteam HTTP/1.1" 200 41200 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:20:52:23 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:52:30 +0000] "GET /favicon.ico HTTP/1.1" 200 4286 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
78.38.112.90 - - [01/Nov/2026:20:52:38 +0000] "GET /course-osint HTTP/1.1" 200 35400 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
5.160.198.42 - - [01/Nov/2026:20:52:47 +0000] "GET /course-server-pentest HTTP/1.1" 200 34200 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
91.108.182.50 - - [01/Nov/2026:20:52:54 +0000] "GET /ctf HTTP/1.1" 200 45200 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
37.255.142.66 - - [01/Nov/2026:20:53:02 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
91.108.182.50 - - [01/Nov/2026:20:53:10 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
46.225.241.77 - - [01/Nov/2026:20:53:18 +0000] "GET /course-osint HTTP/1.1" 200 35400 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
188.253.11.84 - - [01/Nov/2026:20:53:26 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
2.180.95.210 - - [01/Nov/2026:20:53:35 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
158.58.172.44 - - [01/Nov/2026:20:53:42 +0000] "GET /course-osint HTTP/1.1" 200 35400 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
91.92.241.10 - - [01/Nov/2026:20:53:52 +0000] "GET /assets/images/osint-banner.jpg HTTP/1.1" 200 184500 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
5.160.198.42 - - [01/Nov/2026:20:54:00 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
37.255.142.66 - - [01/Nov/2026:20:54:09 +0000] "GET /course-kali-redteam HTTP/1.1" 200 41200 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:54:17 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
91.92.241.10 - - [01/Nov/2026:20:54:23 +0000] "GET /dashboard HTTP/1.1" 200 52300 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
188.253.11.84 - - [01/Nov/2026:20:54:30 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
91.108.182.50 - - [01/Nov/2026:20:54:39 +0000] "GET /course-kali-redteam HTTP/1.1" 200 41200 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
185.143.232.18 - - [01/Nov/2026:20:54:46 +0000] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
37.255.142.66 - - [01/Nov/2026:20:54:54 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
188.253.11.84 - - [01/Nov/2026:20:55:01 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
91.92.241.10 - - [01/Nov/2026:20:55:12 +0000] "GET /assets/images/forensics-banner.jpg HTTP/1.1" 200 192300 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
188.253.11.84 - - [01/Nov/2026:20:55:25 +0000] "GET /assets/images/kali-redteam-banner.jpg HTTP/1.1" 200 210400 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
194.225.24.5 - - [01/Nov/2026:20:55:38 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
37.255.142.66 - - [01/Nov/2026:20:55:50 +0000] "GET /favicon.ico HTTP/1.1" 200 4286 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
151.246.88.19 - - [01/Nov/2026:20:56:01 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
94.182.176.5 - - [01/Nov/2026:20:56:09 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
94.182.176.5 - - [01/Nov/2026:20:56:18 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
5.112.64.129 - - [01/Nov/2026:20:56:27 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
194.225.24.5 - - [01/Nov/2026:20:56:35 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
5.160.198.42 - - [01/Nov/2026:20:56:44 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
2.180.95.210 - - [01/Nov/2026:20:56:51 +0000] "GET /api/auth.php HTTP/1.1" 200 140 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
5.112.64.129 - - [01/Nov/2026:20:57:01 +0000] "GET /assets/images/kali-redteam-banner.jpg HTTP/1.1" 200 210400 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
185.191.171.12 - - [01/Nov/2026:20:57:08 +0000] "GET /assets/images/logo.jpg HTTP/1.1" 200 261284 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
151.246.88.19 - - [01/Nov/2026:20:57:17 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:20:57:25 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
80.191.218.15 - - [01/Nov/2026:20:57:34 +0000] "GET /dashboard HTTP/1.1" 200 52300 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
91.108.182.50 - - [01/Nov/2026:20:57:42 +0000] "GET /api/status HTTP/1.1" 200 114 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
31.56.128.91 - - [01/Nov/2026:20:57:52 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
77.88.5.12 - - [01/Nov/2026:20:57:18 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)"
94.182.176.5 - - [01/Nov/2026:20:58:01 +0000] "GET /api/auth.php HTTP/1.1" 200 140 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
80.191.218.15 - - [01/Nov/2026:20:58:12 +0000] "GET /course-server-pentest HTTP/1.1" 200 34200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
5.112.64.129 - - [01/Nov/2026:20:58:26 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
151.246.88.19 - - [01/Nov/2026:20:58:36 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
91.108.182.50 - - [01/Nov/2026:20:58:50 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
185.165.116.3 - - [01/Nov/2026:20:59:01 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
178.22.122.100 - - [01/Nov/2026:20:59:11 +0000] "GET /assets/images/logo.jpg HTTP/1.1" 200 261284 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
185.143.232.18 - - [01/Nov/2026:20:59:22 +0000] "GET /assets/images/kali-redteam-banner.jpg HTTP/1.1" 200 210400 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
91.108.182.50 - - [01/Nov/2026:20:59:31 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
91.108.182.50 - - [01/Nov/2026:20:59:40 +0000] "GET /roadmap HTTP/1.1" 200 28400 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
151.246.88.19 - - [01/Nov/2026:20:59:50 +0000] "GET /assets/images/forensics-banner.jpg HTTP/1.1" 200 192300 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"

# --- SECTION 2: AUTOMATED EDGE PROBES & PERIMETER RECONNAISSANCE NOISE ---
192.0.2.14 - - [01/Nov/2026:21:01:05 +0000] "GET /.env HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"
192.0.2.14 - - [01/Nov/2026:21:01:17 +0000] "GET /.git/config HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"
192.0.2.14 - - [01/Nov/2026:21:01:29 +0000] "GET /wp-login.php HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"
194.26.29.112 - - [01/Nov/2026:21:01:41 +0000] "GET /phpmyadmin/index.php HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) zgrab/0.x"
194.26.29.112 - - [01/Nov/2026:21:01:53 +0000] "GET /actuator/health HTTP/1.1" 404 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) zgrab/0.x"
45.154.255.87 - - [01/Nov/2026:21:01:65 +0000] "POST /api/v1/debug/shell HTTP/1.1" 404 162 "-" "python-requests/2.31.0"
45.154.255.87 - - [01/Nov/2026:21:01:77 +0000] "GET /config.json HTTP/1.1" 404 162 "-" "python-requests/2.31.0"
89.248.165.71 - - [01/Nov/2026:21:01:89 +0000] "GET /.well-known/security.txt HTTP/1.1" 200 420 "-" "CensysInspect/1.1 (+https://about.censys.io/)"
185.220.101.5 - - [01/Nov/2026:21:01:101 +0000] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "curl/8.4.0"
185.220.101.5 - - [01/Nov/2026:21:01:113 +0000] "GET /telescope/requests HTTP/1.1" 404 162 "-" "curl/8.4.0"
185.191.171.12 - - [01/Nov/2026:21:02:10 +0000] "GET /course-osint HTTP/1.1" 200 35400 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
91.92.241.10 - - [01/Nov/2026:21:02:25 +0000] "POST /api/login.php HTTP/1.1" 200 128 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6)"
178.22.122.100 - - [01/Nov/2026:21:02:40 +0000] "GET /dashboard HTTP/1.1" 200 52300 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

# ==============================================================================
# [SOC ALERT // CYN-IDS-01] ANOMALOUS FOOTPRINTING DETECTED
# TARGET: /api/v1/auth/ AND /api/v1/telemetry/
# HEURISTIC SIGNATURE: SUSPICIOUS RECON SUITE // FINGERPRINT MATCH: ShadowRaven
# ==============================================================================
198.51.100.89 - - [01/Nov/2026:21:02:48 +0000] "GET /robots.txt HTTP/1.1" 200 320 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:02:55 +0000] "HEAD /api/v1/status HTTP/1.1" 200 0 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:03:04 +0000] "GET /api/v1/endpoints.json HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:03:15 +0000] "GET /api/v1/auth/info HTTP/1.1" 404 162 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:03:28 +0000] "OPTIONS /api/v1/auth/session_probe HTTP/1.1" 204 0 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:03:42 +0000] "GET /api/v1/auth/session_probe?probe=ping HTTP/1.1" 401 115 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"

# ==============================================================================
# [CRITICAL INCIDENT AUDIT // DEFCON 2 // ID #SEC-9042-SR]
# INCIDENT START: 2026-11-01 21:04:12 UTC
# ATTACK VECTOR: AUTHENTICATION BYPASS & C2 TOKEN EXFILTRATION PROBE
# ==============================================================================
198.51.100.89 - - [01/Nov/2026:21:04:12 +0000] "HEAD /api/v1/auth/session_probe HTTP/1.1" 401 0 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:04:14 +0000] "GET /api/v1/auth/session_probe?client_id=CYN-9042&token=c2hhZG93X3JldmVyc2VfY2hlY2tzdW1fMjAyNg==&operator=shadow_raven HTTP/1.1" 401 247 "-" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:04:17 +0000] "POST /api/v1/telemetry/inject HTTP/1.1" 403 189 "https://gateway.cynetx.ir/" "Mozilla/5.0 (compatible; ShadowRaven-Recon/2.0; +https://t.me/shadowraven_recon)"
198.51.100.89 - - [01/Nov/2026:21:04:20 +0000] "GET /c2_beacon/buffer_dump.bin?key_fragment_1=0s1nt_&key_fragment_2=c2hhZG93X3RyYWNl&key_fragment_3=_2026 HTTP/1.1" 403 312 "-" "ShadowRaven-ExfilAgent/1.0"
198.51.100.89 - - [01/Nov/2026:21:04:22 +0000] "GET /admin/backdoor.php HTTP/1.1" 403 405 "-" "ShadowRaven-ExfilAgent/1.0"
[01/Nov/2026:21:04:22.481920 +0000] [security2:error] [pid 4921:tid 1402] [client 198.51.100.89:54210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "ShadowRaven" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/rules/cynet_custom.conf"] [line "42"] [id "990142"] [msg "Unauthorized RedTeam Operator Detected // Forensic Artifact Captured"] [data "ShadowRaven-ExfilAgent/1.0"] [severity "CRITICAL"] [tag "CYNET-APT-DFIR"] [hostname "cynetx.ir"] [uri "/admin/backdoor.php"]
[01/Nov/2026:21:04:22.482110 +0000] [iptables:alert] [kernel] CYNET-FW-DROP: IN=eth0 OUT= MAC=52:54:00:12:34:56:00:1b:21:3c:4d:5e:08:00 SRC=198.51.100.89 DST=185.191.171.12 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=49122 PROTO=TCP SPT=54210 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 [ACTION: AUTOMATIC PERIMETER BLACKLIST]

# ==============================================================================
# --- SECTION 3: POST-INCIDENT RECOVERY, SOC MITIGATION & PRODUCTION RESUMPTION ---
# STATUS: HOST ISOLATED // AUTOMATIC DEFENSE ACTIVE // FORENSICS CAPTURED
# ==============================================================================
198.51.100.89 - - [01/Nov/2026:21:04:30 +0000] "GET / HTTP/1.1" 403 0 "-" "ShadowRaven-ExfilAgent/1.0"
198.51.100.89 - - [01/Nov/2026:21:04:35 +0000] "GET /favicon.ico HTTP/1.1" 403 0 "-" "ShadowRaven-ExfilAgent/1.0"
185.191.171.12 - - [01/Nov/2026:21:05:02 +0000] "GET /api/ctf.php?action=session_status HTTP/1.1" 200 184 "https://cynetx.ir/ctf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
185.191.171.12 - - [01/Nov/2026:21:05:18 +0000] "GET /ctf-challenge-1 HTTP/1.1" 200 48200 "https://cynetx.ir/ctf" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
94.182.176.5 - - [01/Nov/2026:21:06:01 +0000] "GET /assets/images/forensics-banner.jpg HTTP/1.1" 200 192300 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
194.225.24.5 - - [01/Nov/2026:21:06:08 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
2.180.95.210 - - [01/Nov/2026:21:06:17 +0000] "GET /course-server-pentest HTTP/1.1" 200 34200 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
78.38.112.90 - - [01/Nov/2026:21:06:23 +0000] "GET /assets/images/forensics-banner.jpg HTTP/1.1" 200 192300 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
151.246.88.19 - - [01/Nov/2026:21:06:31 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
185.143.232.18 - - [01/Nov/2026:21:06:38 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
91.92.241.10 - - [01/Nov/2026:21:06:46 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
185.191.171.12 - - [01/Nov/2026:21:06:52 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
89.199.34.12 - - [01/Nov/2026:21:07:02 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
91.108.182.50 - - [01/Nov/2026:21:07:12 +0000] "GET /api/auth.php HTTP/1.1" 200 140 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
158.58.172.44 - - [01/Nov/2026:21:07:24 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
94.182.176.5 - - [01/Nov/2026:21:07:37 +0000] "GET /api/status HTTP/1.1" 200 114 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
89.199.34.12 - - [01/Nov/2026:21:07:48 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
91.108.182.50 - - [01/Nov/2026:21:08:00 +0000] "GET /assets/images/forensics-banner.jpg HTTP/1.1" 200 192300 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:21:08:09 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
158.58.172.44 - - [01/Nov/2026:21:08:15 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
185.165.116.3 - - [01/Nov/2026:21:08:24 +0000] "GET /api/status HTTP/1.1" 200 114 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
178.22.122.100 - - [01/Nov/2026:21:08:30 +0000] "GET /course-osint HTTP/1.1" 200 35400 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
37.255.142.66 - - [01/Nov/2026:21:08:37 +0000] "GET /api/status HTTP/1.1" 200 114 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
46.225.241.77 - - [01/Nov/2026:21:08:45 +0000] "GET /assets/images/osint-banner.jpg HTTP/1.1" 200 184500 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
185.143.232.18 - - [01/Nov/2026:21:08:54 +0000] "GET /assets/images/logo.jpg HTTP/1.1" 200 261284 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
66.249.66.46 - - [01/Nov/2026:21:08:44 +0000] "GET /ctf HTTP/1.1" 200 45200 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
2.180.95.210 - - [01/Nov/2026:21:09:01 +0000] "GET /course-osint HTTP/1.1" 200 35400 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
151.246.88.19 - - [01/Nov/2026:21:09:12 +0000] "GET /course-osint HTTP/1.1" 200 35400 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
94.182.176.5 - - [01/Nov/2026:21:09:24 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
89.199.34.12 - - [01/Nov/2026:21:09:37 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
5.112.64.129 - - [01/Nov/2026:21:09:50 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
194.225.24.5 - - [01/Nov/2026:21:10:00 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
80.191.218.15 - - [01/Nov/2026:21:10:08 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
37.255.142.66 - - [01/Nov/2026:21:10:16 +0000] "GET /api/auth.php HTTP/1.1" 200 140 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
94.182.176.5 - - [01/Nov/2026:21:10:24 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
89.199.34.12 - - [01/Nov/2026:21:10:31 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
194.225.24.5 - - [01/Nov/2026:21:10:38 +0000] "GET /dashboard HTTP/1.1" 200 52300 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
46.225.241.77 - - [01/Nov/2026:21:10:46 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
78.38.112.90 - - [01/Nov/2026:21:10:52 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
91.108.182.50 - - [01/Nov/2026:21:11:00 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
2.180.95.210 - - [01/Nov/2026:21:11:12 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
5.112.64.129 - - [01/Nov/2026:21:11:20 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
188.253.11.84 - - [01/Nov/2026:21:11:31 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
37.255.142.66 - - [01/Nov/2026:21:11:40 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
185.191.171.12 - - [01/Nov/2026:21:11:51 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
151.246.88.19 - - [01/Nov/2026:21:12:00 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
91.108.182.50 - - [01/Nov/2026:21:12:08 +0000] "GET /course-server-pentest HTTP/1.1" 200 34200 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
185.143.232.18 - - [01/Nov/2026:21:12:19 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
158.58.172.44 - - [01/Nov/2026:21:12:26 +0000] "GET /course-forensics HTTP/1.1" 200 39800 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
194.225.24.5 - - [01/Nov/2026:21:12:35 +0000] "GET /api/courses.php HTTP/1.1" 200 4120 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:21:12:44 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
188.253.11.84 - - [01/Nov/2026:21:12:53 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
178.22.122.100 - - [01/Nov/2026:21:12:10 +0000] "POST /api/ctf.php HTTP/1.1" 200 156 "https://cynetx.ir/ctf-challenge-1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
194.225.24.5 - - [01/Nov/2026:21:13:02 +0000] "GET /dashboard HTTP/1.1" 200 52300 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
158.58.172.44 - - [01/Nov/2026:21:13:10 +0000] "GET /api/status HTTP/1.1" 200 114 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
194.225.24.5 - - [01/Nov/2026:21:13:20 +0000] "GET /course-ai-pentest HTTP/1.1" 200 32100 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
94.182.176.5 - - [01/Nov/2026:21:13:31 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
185.191.171.12 - - [01/Nov/2026:21:13:42 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
5.112.64.129 - - [01/Nov/2026:21:13:52 +0000] "GET /ctf HTTP/1.1" 200 45200 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
158.58.172.44 - - [01/Nov/2026:21:14:00 +0000] "GET /assets/images/kali-redteam-banner.jpg HTTP/1.1" 200 210400 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
91.108.182.50 - - [01/Nov/2026:21:14:10 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
5.112.64.129 - - [01/Nov/2026:21:14:20 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
91.92.241.10 - - [01/Nov/2026:21:14:31 +0000] "GET /roadmap HTTP/1.1" 200 28400 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
80.191.218.15 - - [01/Nov/2026:21:14:42 +0000] "GET /dashboard HTTP/1.1" 200 52300 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
46.225.241.77 - - [01/Nov/2026:21:14:52 +0000] "GET /api/status HTTP/1.1" 200 114 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
91.108.182.50 - - [01/Nov/2026:21:15:00 +0000] "GET /assets/images/logo.jpg HTTP/1.1" 200 261284 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
185.143.232.18 - - [01/Nov/2026:21:15:12 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
5.160.198.42 - - [01/Nov/2026:21:15:21 +0000] "GET /api/status HTTP/1.1" 200 114 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
151.246.88.19 - - [01/Nov/2026:21:15:32 +0000] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
91.92.241.10 - - [01/Nov/2026:21:15:41 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
178.22.122.100 - - [01/Nov/2026:21:15:51 +0000] "GET /assets/images/osint-banner.jpg HTTP/1.1" 200 184500 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
91.92.241.10 - - [01/Nov/2026:21:15:33 +0000] "GET /course-kali-redteam HTTP/1.1" 200 41200 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6)"
94.182.176.5 - - [01/Nov/2026:21:16:01 +0000] "GET /favicon.ico HTTP/1.1" 200 4286 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
185.165.116.3 - - [01/Nov/2026:21:16:10 +0000] "GET /assets/images/ai-pentest-banner.jpg HTTP/1.1" 200 168900 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
89.199.34.12 - - [01/Nov/2026:21:16:21 +0000] "GET /ctf HTTP/1.1" 200 45200 "https://cynetx.ir/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
94.182.176.5 - - [01/Nov/2026:21:16:30 +0000] "GET /api/auth.php HTTP/1.1" 200 140 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
151.246.88.19 - - [01/Nov/2026:21:16:40 +0000] "GET /assets/images/forensics-banner.jpg HTTP/1.1" 200 192300 "https://cynetx.ir/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
2.180.95.210 - - [01/Nov/2026:21:16:51 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
91.108.182.50 - - [01/Nov/2026:21:17:02 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
91.108.182.50 - - [01/Nov/2026:21:17:12 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
89.199.34.12 - - [01/Nov/2026:21:17:20 +0000] "GET /css/style.css HTTP/1.1" 200 48210 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
185.191.171.12 - - [01/Nov/2026:21:17:30 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/537.36"
158.58.172.44 - - [01/Nov/2026:21:17:42 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
151.246.88.19 - - [01/Nov/2026:21:17:50 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
188.253.11.84 - - [01/Nov/2026:21:18:00 +0000] "GET /verify?id=CYN-OSINT-1042 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
91.92.241.10 - - [01/Nov/2026:21:18:12 +0000] "GET /js/main.js HTTP/1.1" 200 31450 "https://cynetx.ir/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"
94.182.176.5 - - [01/Nov/2026:21:18:22 +0000] "GET /assets/images/kali-redteam-banner.jpg HTTP/1.1" 200 210400 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
2.180.95.210 - - [01/Nov/2026:21:18:31 +0000] "GET /api/status HTTP/1.1" 200 114 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
185.165.116.3 - - [01/Nov/2026:21:18:40 +0000] "GET /verify?id=CYN-DFIR-2088 HTTP/1.1" 200 24100 "-" "Mozilla/5.0 (iPad; CPU OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
5.160.198.42 - - [01/Nov/2026:21:18:51 +0000] "GET /assets/images/logo.jpg HTTP/1.1" 200 261284 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"

# ==============================================================================
# END OF INCIDENT SNAPSHOT // CYNET SOC TELEMETRY ARTIFACT #IR-9042
# TOTAL ENTRIES: 284 | INCIDENT TIME-WINDOW: 21:04:12 - 21:04:22 UTC
# DFIR TRIAGE CHECKLIST:
#   [1] Extract Public Attacker IPv4 in Section 2 (Stage 1)
#   [2] Base64-Decode Authentication Token in query string at 21:04:14 (Stage 2)
#   [3] Reconstruct C2 Exfiltration Payload Fragments into Final Flag (Stage 3)
# ==============================================================================