seems to be a nosql dump, and further seems to be railyatri.in based on some investigation (threat actor did not clean up `.order_history[n].track_ref_deep_link

seems to be a nosql dump, and further seems to be railyatri.in based on some investigation (threat actor did not clean up `.order_history[n].track_ref_deep_link` properly)