{"report_id":"0505ecbe-5748-40d7-9de0-79450f5b65e0","version":0,"status":"done","tags":["microsoft","phishing"],"date":"2026-08-17T20:27:53Z","url":{"schema":"http","addr":"ozatak.com/office","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ozatak.com/office/","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"title":"Sign in to your account","dom":{"size":791947,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (36886)","md5":"7913c82841603b89b8eb0f3db3eb64fa","sha1":"53e573121c4dd36f45d3fbdfcc59c04c746d0ab5","sha256":"b55baaea553167ee1db329a43fe9c46a4ea980135207ea4fb0f807cdfba94299","sha512":"3e3f722715efb0dc43ec8642048e25129458ab257a3a8f8527ed0727eb059988efbcb63741ff1e7cf268ce225b11ad8399ebbe0ea6ef870751c62332d4e7cb00","ssdeep":"6144:yJiUs059R1YRjga12AfoWlKO+9Cx+oA4/GVS6DxCUOinDShTotPezfq2gaTevlSk:hU9zrtIx+oA4hEGotP8pgaTeeA5","tlshash":"00f47dcc73e6f262875a42ab009b0906f33a19a56c5d4454f229ea9f39f4c4560f7fbc","dom_hash":"domhash6dc44971f63308010b72b6bac322e2cc","first_seen":"2026-08-17T20:27:57.277444Z","last_seen":"2026-08-18T03:29:30.711759Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ozatak.com/office","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-21T20:27:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-08-16T22:33:33.289447Z","alert_count":0,"request_count":1,"received_data":634,"sent_data":458,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ozatak.com","ip":{"addr":"172.67.133.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-02-02","domain_rank":0,"first_seen":"2026-08-17T20:00:25.230653Z","last_seen":"2026-08-17T20:00:25.230654Z","alert_count":4,"request_count":4,"received_data":1238394,"sent_data":1907,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ozatak.com/dzew/","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ee191354db735fc8f134ad0bb38133db","sha1":"7f18e1d387ccfd1a969807c74449b12da30c9bb6","sha256":"1635b8c9471564ba5cdbc20cba2542ad948cf8afc1fb8cabae1fe4712186dda0","sha512":"085241d9c6022d93b83d55b5a6bf647ef167cd4a6fcf772c5b998ec308fa01e23f2edcdf607feda1144391e74bfa4ef79e9ed6021533dc6f2a5d96a7ee4cbfd4","ssdeep":"6144:6uBMXTBD/1ESGC0FX3iRx9EOzYhcgLsegErl3POi6raMAsP4stqN:6uBOAxFX+xbVrEE4st0","tlshash":"cba4f7cdb3d670629396f478503f018ba57a69e2b44cc899f189c8e42e7469a4237f7c","size":488399,"data":"","first_seen":"2026-08-17T20:00:37.879269Z","last_seen":"2026-08-17T20:27:57.28669Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=AW-11185924388\u0026gtg_health=1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ffbb935556b923eee5ff8477b0756493","sha1":"308b9226bf682ba28a92a743b4ddf4e9a96157f1","sha256":"c24c8a68f1ffcf9b37963dfdf26c4874c307feceac1245180f85db1da436416a","sha512":"9a3af3a979c26255bc27b508e7226859f22a732b120360763f70a5fe2c59f422b816c07905ddfa76f151b993f72dd0f50dd4a540e4bf572aba5afe1fdfe7c8d3","ssdeep":"","tlshash":"e4d023cdb1cc31502497f530b19fc1271013d25d4ec0d1843514ecbb0d622cb42137ab","size":216,"data":"","first_seen":"2026-03-17T00:15:22.957568Z","last_seen":"2026-08-18T06:22:43.942645Z","times_seen":37081,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ozatak.com/office/","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"1c862db5f2555377c2dc1e62ed7b3981","sha1":"c29e6dc25c08a70995127ec13ded6f80d9a36174","sha256":"27d373a6961f797edf69a80f7f24877ef85c2fc4f9f770b2540b1bf5e66823ac","sha512":"31143265b96385ef4b575b72591775139057dff85891be61591e3d55259b6d1dc95d86a0feec40c801d38e64278cfbe50c3c2a16757f986ad40f716935bf2bb2","ssdeep":"","tlshash":"2580008a208820008aa323a0002b2c8800a000b028808c808080e8a20ca2030220baac","size":26,"data":"","first_seen":"2023-04-11T21:13:06Z","last_seen":"2026-08-18T06:38:21.773123Z","times_seen":383808,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ozatak.com/office/favicon-C_Ub-jv0.ico","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ozatak.com/office/","date":"2026-08-17T20:27:22.028Z","timestamp":1786998442028,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ozatak.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 03 Jul 2026 22:32:25 GMT","end":"Thu, 01 Oct 2026 23:30:59 GMT"},"fingerprint":{"sha1":"E8:B0:9D:50:A2:E6:B0:D4:97:31:16:8D:70:0D:F1:52:42:5A:47:55","sha256":"A3:A3:8D:68:48:30:58:04:E6:74:D9:3C:5D:7E:A8:A7:D0:97:F9:E4:06:65:E7:FA:2A:1F:B8:14:79:D2:82:2B"}}},"request":{"raw":"GET /office/favicon-C_Ub-jv0.ico HTTP/1.1\r\nHost: ozatak.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ozatak.com/office/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Mon, 24 Aug 2026 20:27:22 GMT\r\ncontent-type: image/x-icon\r\nlast-modified: Sat, 25 Jul 2026 17:38:35 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bHPOMW5vZ6eezwG5zleCXokGeGxzsUEzjqakKtobZo1Q9DspKZpAV2sXXYyyHpQlwJRKus6SbTcsrJzMY91paKbXRDjpUaKKoBWvk0hArNRV%2FjUHLD%2BhbNpdqueE\"}]}\r\nserver: cloudflare\r\ndate: Mon, 17 Aug 2026 20:27:22 GMT\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: zstd\r\npriority: u=6,i=?0\r\ncf-ray: a2cb6b46aa6f2efa-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17174,"size_decoded":1275,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors","md5":"12e3dac858061d088023b2bd48e2fa96","sha1":"e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5","sha256":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21","sha512":"c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01","ssdeep":"24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO","tlshash":"b772e35b1f5f4981ec4b0db80b125e80c5e49c973854dffbdb76b62888b0364ab845eb","first_seen":"2023-04-05T03:19:57Z","last_seen":"2026-08-18T05:50:51.248515Z","times_seen":171996,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":360,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=AW-11185924388\u0026gtg_health=1","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ozatak.com/office/","date":"2026-08-17T20:27:22.406Z","timestamp":1786998442406,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:42:22 GMT","end":"Wed, 28 Oct 2026 20:42:21 GMT"},"fingerprint":{"sha1":"0C:36:58:3E:92:12:11:BD:3B:2C:77:32:B6:09:4D:99:02:12:5E:BB","sha256":"4C:2B:BB:AD:FE:07:99:6D:8E:58:81:DD:95:E6:E7:0B:1E:E2:BE:C1:0C:B5:DD:78:EB:1E:D6:2C:91:CE:30:0E"}}},"request":{"raw":"GET /gtag/js?id=AW-11185924388\u0026gtg_health=1 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Mon, 17 Aug 2026 20:27:22 GMT\r\nexpires: Mon, 17 Aug 2026 20:27:22 GMT\r\ncache-control: private, max-age=900\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 137\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":216,"size_decoded":555,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text","md5":"ffbb935556b923eee5ff8477b0756493","sha1":"308b9226bf682ba28a92a743b4ddf4e9a96157f1","sha256":"c24c8a68f1ffcf9b37963dfdf26c4874c307feceac1245180f85db1da436416a","sha512":"9a3af3a979c26255bc27b508e7226859f22a732b120360763f70a5fe2c59f422b816c07905ddfa76f151b993f72dd0f50dd4a540e4bf572aba5afe1fdfe7c8d3","ssdeep":"","tlshash":"e4d023cdb1cc31502497f530b19fc1271013d25d4ec0d1843514ecbb0d622cb42137ab","first_seen":"2026-03-17T00:15:22.957568Z","last_seen":"2026-08-18T06:22:43.942645Z","times_seen":37081,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":31,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ozatak.com/office","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-17T20:27:20.930Z","timestamp":1786998440930,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ozatak.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 03 Jul 2026 22:32:25 GMT","end":"Thu, 01 Oct 2026 23:30:59 GMT"},"fingerprint":{"sha1":"E8:B0:9D:50:A2:E6:B0:D4:97:31:16:8D:70:0D:F1:52:42:5A:47:55","sha256":"A3:A3:8D:68:48:30:58:04:E6:74:D9:3C:5D:7E:A8:A7:D0:97:F9:E4:06:65:E7:FA:2A:1F:B8:14:79:D2:82:2B"}}},"request":{"raw":"GET /office HTTP/1.1\r\nHost: ozatak.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 301 \r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oeu8xLjIhNOAIX%2FQIaplAtnX3EmIE%2F7XUdOc%2By27c8TXoM7aZz8UzQeMpt9UdLrlFFctRVvAhC%2B7zXIbyoaWHTQ84HBE0ecZOZZ0O9LwvHq7fkfV26feWtXoRHsR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Mon, 17 Aug 2026 20:27:21 GMT\r\nlocation: https://ozatak.com/office/\r\ncontent-type: text/html\r\npriority: u=0,i\r\ncf-ray: a2cb6b402fe82efa-OSL\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nreferrer-policy: same-origin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-18T06:37:20.775643Z","times_seen":17950797,"resource_available":true,"data":null}},"time_used":301,"timings":{"blocked":-1,"dns":35,"connect":15,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ozatak.com/office/","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-17T20:27:21.240Z","timestamp":1786998441240,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ozatak.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 03 Jul 2026 22:32:25 GMT","end":"Thu, 01 Oct 2026 23:30:59 GMT"},"fingerprint":{"sha1":"E8:B0:9D:50:A2:E6:B0:D4:97:31:16:8D:70:0D:F1:52:42:5A:47:55","sha256":"A3:A3:8D:68:48:30:58:04:E6:74:D9:3C:5D:7E:A8:A7:D0:97:F9:E4:06:65:E7:FA:2A:1F:B8:14:79:D2:82:2B"}}},"request":{"raw":"GET /office/ HTTP/1.1\r\nHost: ozatak.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=0,i\r\ndate: Mon, 17 Aug 2026 20:27:21 GMT\r\ncontent-type: text/html\r\ncontent-encoding: zstd\r\ncf-ray: a2cb6b41b8632efa-OSL\r\ncf-cache-status: DYNAMIC\r\nlast-modified: Thu, 30 Jul 2026 12:09:09 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nreferrer-policy: same-origin\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uMOc4ejC75ulgE1bSuWgS3WqCey1VdpHWI9uoDZ%2FJCaEIjMHVSkatXwTefPYL1ZMDcvfHixNuJS67PTTHL2etgz9C01pePoqqkV9q7yP%2F3zlsPbD1WplTdsvPrZt\"}]}\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":729792,"size_decoded":209147,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (36998)","md5":"1d1960de1b89b5b21523e89fc37fe2a9","sha1":"8bf2d4d2ca3bd0c6d20b81670c6fe52a20a2bdb2","sha256":"a7a0d3205e36f7d54c8168ab22c8d6e2608555dfb9e3bb5782707a1053a8c40a","sha512":"9ab6bbd21974c8891587585a4d26c59729fd9bc30fdcb97efbb5dcee0e7e5f8f39f63cbb0b00fb1ae38c8a193387ad19ae64d8636fc9fd3a9a41249a9b3c6cf7","ssdeep":"6144:BJiUs059R1YRjga12AfoWlKO+9Cx+oA4/GVS6DxCUOinDShTotPezfq2gaTev+Sq:2U9zrtIx+oA4hEGotP8pgaTeR4","tlshash":"e4f46ccd73eaf662879a01a7009b0906f37a18a51c5d4454f228eadf75e5c8460fbfbc","first_seen":"2026-08-17T20:27:57.285054Z","last_seen":"2026-08-18T03:29:30.714305Z","times_seen":2,"resource_available":false,"data":null}},"time_used":378,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":362,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ozatak.com/dzew/","fqdn":"ozatak.com","domain":"ozatak.com","tld":"com"},"ip":{"addr":"172.67.133.85","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ozatak.com/office/","date":"2026-08-17T20:27:21.801Z","timestamp":1786998441801,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ozatak.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 03 Jul 2026 22:32:25 GMT","end":"Thu, 01 Oct 2026 23:30:59 GMT"},"fingerprint":{"sha1":"E8:B0:9D:50:A2:E6:B0:D4:97:31:16:8D:70:0D:F1:52:42:5A:47:55","sha256":"A3:A3:8D:68:48:30:58:04:E6:74:D9:3C:5D:7E:A8:A7:D0:97:F9:E4:06:65:E7:FA:2A:1F:B8:14:79:D2:82:2B"}}},"request":{"raw":"GET /dzew/ HTTP/1.1\r\nHost: ozatak.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://ozatak.com/office/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ndate: Mon, 17 Aug 2026 20:27:21 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\npriority: u=3,i=?0\r\ncf-ray: a2cb6b4549fd2efa-OSL\r\ncf-cache-status: DYNAMIC\r\ncache-control: private, max-age=900\r\ncontent-encoding: br\r\nexpires: Mon, 17 Aug 2026 20:27:21 GMT\r\nlast-modified: Mon, 17 Aug 2026 18:50:43 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\naccess-control-allow-headers: Cache-Control\r\nalt-svc: h3=\":443\"; ma=86400\r\ncross-origin-resource-policy: cross-origin\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6EUnc2NSdzrYpN4v9WXQb0nM86KvZCrMfIc1sl6g27WfmoZ4kLWcQ2XteGLrBr6m20mBeMPccvpgGMecP8UM%2BiziG0TEUt65hHYhYHu7YJwSq9KLFjKOx1PJfmB2\"}]}\r\ncontent-length: 164047\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":488399,"size_decoded":164893,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6662)","md5":"ee191354db735fc8f134ad0bb38133db","sha1":"7f18e1d387ccfd1a969807c74449b12da30c9bb6","sha256":"1635b8c9471564ba5cdbc20cba2542ad948cf8afc1fb8cabae1fe4712186dda0","sha512":"085241d9c6022d93b83d55b5a6bf647ef167cd4a6fcf772c5b998ec308fa01e23f2edcdf607feda1144391e74bfa4ef79e9ed6021533dc6f2a5d96a7ee4cbfd4","ssdeep":"6144:6uBMXTBD/1ESGC0FX3iRx9EOzYhcgLsegErl3POi6raMAsP4stqN:6uBOAxFX+xbVrEE4st0","tlshash":"cba4f7cdb3d670629396f478503f018ba57a69e2b44cc899f189c8e42e7469a4237f7c","first_seen":"2026-08-17T20:00:37.879269Z","last_seen":"2026-08-17T20:27:57.28669Z","times_seen":2,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":166,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}