{"report_id":"0271f46c-0feb-48fa-acb9-fecfcdc8dc58","version":0,"status":"done","tags":["microsoft","phishing"],"date":"2026-09-27T14:49:53Z","url":{"schema":"http","addr":"webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","fqdn":"webfun.website","domain":"webfun.website","tld":"website"},"ip":{"addr":"108.157.214.73","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","fqdn":"webfun.website","domain":"webfun.website","tld":"website"},"title":"Sign in to your Microsoft account","dom":{"size":141079,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (64993)","md5":"35aa414df1220362376f5d8efeec73ef","sha1":"e80de4a10d435611bd208acc44a6c0ac75b1ce5e","sha256":"5af2ea623517971d1d4bcb8111f5b6d9cb0ce137402df97cc4f655e7f02d145a","sha512":"cf53f6ab3a4e0eacb4db1c2ae061787aea434b10414b746526ef2ebdaf9b86b96c89f52a2492911403eb98487ebd2b227f76b1d3e4e5d98b2e9238f2d0774677","ssdeep":"1536:I6U3H325A5ylWJcpmJ3eT5e/clpU5dotqnGd:I693","tlshash":"32d33f4f5e2339199c53e5682fe15c06b33120f1d12fe4ae7e8da7a8d38d6488b61bc5","dom_hash":"domhash3efd5e9a86b6a8d41cb939ab9610335b","first_seen":"2026-07-19T05:24:40.76705Z","last_seen":"2026-09-27T16:13:16.153506Z","times_seen":6,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","fqdn":"webfun.website","domain":"webfun.website","tld":"website"},"ip":{"addr":"108.157.214.73","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-01T14:49:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"webfun.website","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"webfun.website","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"cloud.phishinsight.trendmicro.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"cloud.phishinsight.trendmicro.com","ip":{"addr":"65.9.62.12","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"1995-04-20","domain_rank":0,"first_seen":"2022-05-31T12:32:07Z","last_seen":"2026-09-21T06:13:30.302871Z","alert_count":4,"request_count":4,"received_data":290781,"sent_data":2359,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]},{"fqdn":"webfun.website","ip":{"addr":"108.157.214.73","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2018-07-13","domain_rank":593271,"first_seen":"2021-02-04T05:25:36Z","last_seen":"2026-09-21T06:13:30.442204Z","alert_count":6,"request_count":2,"received_data":142270,"sent_data":1173,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","fqdn":"webfun.website","domain":"webfun.website","tld":"website"},"ip":{"addr":"108.157.214.73","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-27T14:49:22.792Z","timestamp":1790520562792,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webfun.website","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 09 Aug 2026 00:00:00 GMT","end":"Mon, 22 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D2:32:2F:28:A7:37:7C:BB:E6:3E:4A:F3:ED:74:53:45:49:63:5D:78","sha256":"9E:5A:99:16:19:98:F9:C1:99:B3:B3:D4:24:E7:85:2D:23:DA:93:E1:A3:F7:8C:8B:DC:64:3E:01:B4:A4:86:D9"}}},"request":{"raw":"GET /landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs HTTP/1.1\r\nHost: webfun.website\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 20431\r\ndate: Sun, 27 Sep 2026 14:49:23 GMT\r\nx-amzn-trace-id: Root=1-6ab92cf2-0ad6197c3d4680805837d9ea\r\nx-amzn-requestid: 1ecf676b-67c7-4835-a904-94f65c123453\r\ncontent-encoding: br\r\nx-amzn-remapped-content-length: 20431\r\nx-amz-apigw-id: EXP2CHIIDoEEAXw=\r\nvary: Accept-Encoding\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 a626e6748fd7659cdc58de81924341d6.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: 5Vlgrxr9J-nN6RCSx1i_ylkyquao2bk9FiAtLWiAZ8RRZRDyx7MHLA==\r\nx-robots-tag: noindex\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":141091,"size_decoded":21019,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (64957)","md5":"05c15a262e2b6e0b3e236fc31f8c9670","sha1":"65d803d571a4b288d88a269fd1767903b26576c8","sha256":"b66c4a1726d6200763791bc49f5661b8134169fc98caf804c256d809fc872dd7","sha512":"7b7c064fa8ec86138346e7cd94ce08f8ab10c48d66d93b659062729f8eeb3aba1ee6fc25b10d889990f3b4d397b895e4d876d07038b57d222f3961e330028a52","ssdeep":"1536:38U3H325A5ylWJcpmJ3eT5e/clpU5dotqnBM:389D","tlshash":"5fd33f4f5e2339199c53e5682fe15c06b33120f1d11fe4ae7e8da7a8d38d6488b61bc5","first_seen":"2026-02-19T17:22:01.201577Z","last_seen":"2026-09-27T16:13:16.155549Z","times_seen":13,"resource_available":true,"data":null}},"time_used":379,"timings":{"blocked":0,"dns":13,"connect":9,"send":0,"wait":342,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"webfun.website","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"webfun.website","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ellipsis_white.svg","fqdn":"cloud.phishinsight.trendmicro.com","domain":"trendmicro.com","tld":"com"},"ip":{"addr":"65.9.62.12","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","date":"2026-09-27T14:49:23.590Z","timestamp":1790520563590,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.phishinsight.trendmicro.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 10 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"4D:7B:5D:8C:09:8D:9B:39:42:BA:C1:96:21:E7:49:51:33:DA:80:1E","sha256":"F0:88:AA:68:0F:48:07:0B:4E:7D:F8:1A:B7:0C:2F:F1:0A:F4:AB:89:C1:17:60:8D:C1:49:42:5D:C3:0B:90:A2"}}},"request":{"raw":"GET /content/lps/assets/system/img/ellipsis_white.svg HTTP/1.1\r\nHost: cloud.phishinsight.trendmicro.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://webfun.website/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/svg+xml\r\ncontent-length: 915\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nlast-modified: Wed, 29 Mar 2023 03:33:07 GMT\r\nx-amz-version-id: dUt9P30axFdtNrq4Cu4WPOEvNnI6wHHQ\r\nx-amz-server-side-encryption: AES256\r\nx-amz-replication-status: COMPLETED\r\ndate: Sun, 27 Sep 2026 11:34:57 GMT\r\netag: \"5ac590ee72bfe06a7cecfd75b588ad73\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 05602347547794c1a811adf6beb2f2ee.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P4\r\nx-amz-cf-id: wtjhmPnVGBF90SyBvbWcSdWTAfCvMvCfrRxGxIQw9kTyyM09JNRopg==\r\nage: 11667\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":915,"size_decoded":1564,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5ac590ee72bfe06a7cecfd75b588ad73","sha1":"dda2cb89a241bc424746d8cf2a22a35535094611","sha256":"6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea","sha512":"b9135d934b9ea50b51bb0316e383b114c8f24dfe75fef11dcbd1c96170ea59202f6bafe11aaf534cc2f4ed334a8ea4dbe96af2504130896d6203bfd2da69138f","ssdeep":"","tlshash":"6511c9bb2f78c66ea08197943762a7791f76a14873893590f3432f21ee44dbb2039c40","first_seen":"2023-04-30T18:11:00Z","last_seen":"2026-09-27T16:14:11.379328Z","times_seen":4808,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":45,"connect":8,"send":0,"wait":31,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"cloud.phishinsight.trendmicro.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/ellipsis_grey.svg","fqdn":"cloud.phishinsight.trendmicro.com","domain":"trendmicro.com","tld":"com"},"ip":{"addr":"65.9.62.12","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","date":"2026-09-27T14:49:23.592Z","timestamp":1790520563592,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.phishinsight.trendmicro.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 10 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"4D:7B:5D:8C:09:8D:9B:39:42:BA:C1:96:21:E7:49:51:33:DA:80:1E","sha256":"F0:88:AA:68:0F:48:07:0B:4E:7D:F8:1A:B7:0C:2F:F1:0A:F4:AB:89:C1:17:60:8D:C1:49:42:5D:C3:0B:90:A2"}}},"request":{"raw":"GET /content/lps/assets/system/img/ellipsis_grey.svg HTTP/1.1\r\nHost: cloud.phishinsight.trendmicro.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://webfun.website/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/svg+xml\r\ncontent-length: 915\r\naccept-ranges: bytes\r\ndate: Sun, 27 Sep 2026 05:24:58 GMT\r\nserver: AmazonS3\r\nlast-modified: Wed, 29 Mar 2023 03:33:06 GMT\r\netag: \"2b5d393db04a5e6e1f739cb266e65b4c\"\r\nx-amz-version-id: o.HbAr0JQpOCthSbWvL.zKTok_bkIs6W\r\nx-amz-server-side-encryption: AES256\r\nx-amz-replication-status: COMPLETED\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 05602347547794c1a811adf6beb2f2ee.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P4\r\nx-amz-cf-id: nq1-BS6y8t3Xuhy6jWzjTz0Q0csb7OPhmtlq2P55Ia0sUGPuLJz5gw==\r\nage: 33865\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":915,"size_decoded":1564,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2b5d393db04a5e6e1f739cb266e65b4c","sha1":"6a435df5cac3d58ccad655fe022ccf3dd4b9b721","sha256":"16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6","sha512":"3a692635ee8ebd7b15930e78d9e7e808e48c7ed3ed79003b8ca6f9290fa0e2b0fa3573409001489c00fb41d5710e75d17c3c4d65d26f9665849fb7406562a406","ssdeep":"","tlshash":"4211c9bb2f78c66ea09197943762a7791f76a14873883590f3432f11ee44dbb203dc40","first_seen":"2023-04-14T08:32:49Z","last_seen":"2026-09-27T16:14:11.380065Z","times_seen":15923,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":44,"connect":8,"send":0,"wait":31,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"cloud.phishinsight.trendmicro.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/owa_small.jpg","fqdn":"cloud.phishinsight.trendmicro.com","domain":"trendmicro.com","tld":"com"},"ip":{"addr":"65.9.62.12","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","date":"2026-09-27T14:49:23.594Z","timestamp":1790520563594,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.phishinsight.trendmicro.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 10 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"4D:7B:5D:8C:09:8D:9B:39:42:BA:C1:96:21:E7:49:51:33:DA:80:1E","sha256":"F0:88:AA:68:0F:48:07:0B:4E:7D:F8:1A:B7:0C:2F:F1:0A:F4:AB:89:C1:17:60:8D:C1:49:42:5D:C3:0B:90:A2"}}},"request":{"raw":"GET /content/lps/assets/system/img/owa_small.jpg HTTP/1.1\r\nHost: cloud.phishinsight.trendmicro.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://webfun.website/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/jpeg\r\ncontent-length: 3006\r\ndate: Sun, 27 Sep 2026 05:24:59 GMT\r\nx-amz-replication-status: COMPLETED\r\nlast-modified: Wed, 29 Mar 2023 03:33:26 GMT\r\netag: \"138bcee624fa04ef9b75e86211a9fe0d\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: Zq5xzk2hV5K5yzYc9yC545xXUpebH8e8\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 05602347547794c1a811adf6beb2f2ee.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P4\r\nx-amz-cf-id: u9ms5WWT9ZoctaHVQEQLaMq9gk9AOB-l17GlvRSaqdP2eDCaPjIamQ==\r\nage: 33865\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":3006,"size_decoded":3653,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x28, components 3","md5":"138bcee624fa04ef9b75e86211a9fe0d","sha1":"23bbcdaaebd6c9a6e57e96e44493b2212860fcab","sha256":"f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea","sha512":"d20765e5738f4ac5a91396b5f5d88057c3b5125840bce42039ac9d5d75b1c3fb9629aca6290a475625dfe60887cf59d4fb52108d024ff4fa8094c9b8458f9f33","ssdeep":"","tlshash":"4b51631dbd235409ea89ef3a34e00113b72a0502a6a16e0e35ce440f97660a56d1a9cb","first_seen":"2023-04-30T16:38:31Z","last_seen":"2026-09-27T16:14:11.37564Z","times_seen":4027,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":42,"connect":7,"send":0,"wait":11,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"cloud.phishinsight.trendmicro.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cloud.phishinsight.trendmicro.com/content/lps/assets/system/img/owa.jpg","fqdn":"cloud.phishinsight.trendmicro.com","domain":"trendmicro.com","tld":"com"},"ip":{"addr":"65.9.62.12","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","date":"2026-09-27T14:49:23.595Z","timestamp":1790520563595,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.phishinsight.trendmicro.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Wed, 10 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"4D:7B:5D:8C:09:8D:9B:39:42:BA:C1:96:21:E7:49:51:33:DA:80:1E","sha256":"F0:88:AA:68:0F:48:07:0B:4E:7D:F8:1A:B7:0C:2F:F1:0A:F4:AB:89:C1:17:60:8D:C1:49:42:5D:C3:0B:90:A2"}}},"request":{"raw":"GET /content/lps/assets/system/img/owa.jpg HTTP/1.1\r\nHost: cloud.phishinsight.trendmicro.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://webfun.website/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/jpeg\r\ncontent-length: 283351\r\naccept-ranges: bytes\r\ndate: Sun, 27 Sep 2026 05:24:58 GMT\r\nserver: AmazonS3\r\nlast-modified: Wed, 29 Mar 2023 03:33:26 GMT\r\netag: \"a5dbd4393ff6a725c7e62b61df7e72f0\"\r\nx-amz-version-id: VpgbkiTgqex6.caIcfRjZ0874k7J4CJ5\r\nx-amz-server-side-encryption: AES256\r\nx-amz-replication-status: COMPLETED\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 05602347547794c1a811adf6beb2f2ee.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P4\r\nx-amz-cf-id: wP2gUaifzkGbgSRZA288teEmXCfBLzBimmQ3qHs-G_n4IL6S3UZgMg==\r\nage: 33865\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":283351,"size_decoded":284000,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1920x1080, components 3","md5":"a5dbd4393ff6a725c7e62b61df7e72f0","sha1":"55b292f885ffc92abce18750b07aa4acfa4e903e","sha256":"211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb","sha512":"850586a05b67ef25492bd50a090f1ec0a0cc21dc4e4efeb35e19cdc78a98f9415a3807318fa02664eade87f0e2d8fa2a2958cd0d712329800fc05689e01dc614","ssdeep":"6144:hPgRhluS12CyK8XGsLzsr5XONnQ4/bEmhZSIj6xU2zyOX/:2vz1pyWsLoXqN/YWPUU2OOX/","tlshash":"e254238583b10237052a6c656d182262d7ff0b6a4a5831b0fcddf9d3b776eba018fd54","first_seen":"2023-04-30T18:11:00Z","last_seen":"2026-09-27T16:14:11.376588Z","times_seen":4601,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":40,"connect":8,"send":0,"wait":12,"receive":20,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"cloud.phishinsight.trendmicro.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webfun.website/favicon.ico","fqdn":"webfun.website","domain":"webfun.website","tld":"website"},"ip":{"addr":"108.157.214.73","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs","date":"2026-09-27T14:49:23.732Z","timestamp":1790520563732,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webfun.website","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Sun, 09 Aug 2026 00:00:00 GMT","end":"Mon, 22 Feb 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D2:32:2F:28:A7:37:7C:BB:E6:3E:4A:F3:ED:74:53:45:49:63:5D:78","sha256":"9E:5A:99:16:19:98:F9:C1:99:B3:B3:D4:24:E7:85:2D:23:DA:93:E1:A3:F7:8C:8B:DC:64:3E:01:B4:A4:86:D9"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: webfun.website\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://webfun.website/landingpages/cf1a9771-107e-471b-986d-361ea44c2f10/8owznfalqzhcxno92zeuq4taztvl98htcyfkkrq5ijs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: application/json\r\ncontent-length: 42\r\ndate: Sun, 27 Sep 2026 14:49:23 GMT\r\nx-amzn-trace-id: Root=1-6ab92cf3-4ef1008b61d8ed6c039cf656\r\nx-amzn-requestid: 73d1b626-2032-4063-957e-b85895355411\r\nx-amzn-errortype: MissingAuthenticationTokenException\r\nx-amz-apigw-id: EXP2LF-CDoEEglA=\r\nx-cache: Error from cloudfront\r\nvia: 1.1 a626e6748fd7659cdc58de81924341d6.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: A1uR-kgQYAluIyix7sw7hWTRsCIhB-N_vxyE-5Y2HAz71FPAAGUACQ==\r\nx-robots-tag: noindex\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":42,"size_decoded":591,"mime_type":"application/json","magic":"JSON text data","md5":"905b1fbb26e082557ff0b3b3553cda6c","sha1":"8fe0790d6026998bdb2c9ffa3b915952e613e1b4","sha256":"f249b63cb2fcb66b47e86f906c98f8fd912e82dd035b4e53d7e72fc1960cfd16","sha512":"284567e83a5c15761498249b27b4b700aa081a65b858f29458e5d0f3debdea93dd5cfad94eefaeb43837e70cc288b2a34ea168d2771cb57c993e269c287097ce","ssdeep":"","tlshash":"42900455c1401d45cf430313775070c04711015405c434014c14d4dd010541543f3557","first_seen":"2023-04-05T03:12:38Z","last_seen":"2026-09-27T16:14:11.377452Z","times_seen":6830,"resource_available":true,"data":null}},"time_used":104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"webfun.website","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"webfun.website","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}