{"report_id":"1209aba5-6e99-4d9c-ade4-290b0e36a837","version":0,"status":"done","tags":[],"date":"2026-08-04T00:04:03Z","url":{"schema":"http","addr":"verification-salesforce.com/","fqdn":"verification-salesforce.com","domain":"verification-salesforce.com","tld":"com"},"ip":{"addr":"185.26.238.176","port":0,"asn":9009,"as":"M247 Europe SRL","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"http","addr":"verification-salesforce.com/","fqdn":"verification-salesforce.com","domain":"verification-salesforce.com","tld":"com"},"title":"verification-salesforce.com/","dom":{"size":139,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"0e939b847adfbba3b8a22d6172f5bc72","sha1":"0a95975a41afb64585e9ff7148fdb1af0838bde1","sha256":"efaf8b29f0ada7910b53fa0278aa5352df53511e221d3e2e53915b067119d3da","sha512":"07d2b742985351d75fb6deb4b66df7fcf89a7f9f50636a84904ede5183d4b3118037914bb91552334028e3751bd843d865d49f3dda47369952bb9c4dbc8d357b","ssdeep":"","tlshash":"d9c02bb76100181ff2747ac9d882211465805004e2260c21b3410428c0c425c808dfc1","dom_hash":"domhashc1fec9cafeadbac0b33c1409ff211c3f","first_seen":"2026-07-03T09:43:26.527199Z","last_seen":"2026-08-04T00:04:04.257456Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"verification-salesforce.com/","fqdn":"verification-salesforce.com","domain":"verification-salesforce.com","tld":"com"},"ip":{"addr":"185.26.238.176","port":0,"asn":9009,"as":"M247 Europe SRL","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-08T00:04:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-03","alert":"Sinkholed","trigger":"verification-salesforce.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"verification-salesforce.com","ip":{"addr":"185.26.238.176","port":443,"asn":9009,"as":"M247 Europe SRL","country":"Germany","country_code":"DE"},"domain_registered":"2026-06-29","domain_rank":0,"first_seen":"2026-08-03T23:55:45.464422Z","last_seen":"2026-08-03T23:55:45.464422Z","alert_count":3,"request_count":3,"received_data":1082,"sent_data":1350,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"verification-salesforce.com/","fqdn":"verification-salesforce.com","domain":"verification-salesforce.com","tld":"com"},"ip":{"addr":"185.26.238.176","port":443,"asn":9009,"as":"M247 Europe SRL","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-04T00:03:37.389Z","timestamp":1785801817389,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"verification-salesforce.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Jun 2026 20:54:00 GMT","end":"Sun, 27 Sep 2026 20:53:59 GMT"},"fingerprint":{"sha1":"D3:64:3D:B8:DD:91:43:45:64:F6:62:26:8D:74:9B:50:5D:85:A5:5C","sha256":"EB:D7:EE:FD:08:4F:9D:12:D4:04:D5:27:40:B4:D6:EC:01:B8:69:2B:A6:2E:D5:5C:13:D1:0C:E8:5D:DE:8B:3C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: verification-salesforce.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 502 Bad Gateway\r\nServer: nginx/1.30.3\r\nDate: Tue, 04 Aug 2026 00:03:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 15\r\nConnection: keep-alive\r\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nSurrogate-Control: no-store\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15,"size_decoded":309,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"ece4f2496fd3e47a3aec9e5f015710e5","sha1":"1a37913906e4d90313c9b89ec6cbdd853e56911d","sha256":"930cb379321f6ce3cdaf5db7d4348290945e3702b0a04cd04622e9138dc31289","sha512":"fc1aea69908a114d701ab502191adf6370ab7d26c274224200db6d52eacfec293c2dd633224cdb45cc92eef9f37df139b4d2852adac5f44026e0d935373f310a","ssdeep":"","tlshash":"c4600030c3003c3030cf330cc00000000000cc0000000c00000ccc0c0000c0c000c3c3","first_seen":"2023-11-07T18:17:21Z","last_seen":"2026-08-04T00:04:04.259661Z","times_seen":11,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":3,"connect":22,"send":0,"wait":84,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-03","alert":"Sinkholed","trigger":"verification-salesforce.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"verification-salesforce.com/","fqdn":"verification-salesforce.com","domain":"verification-salesforce.com","tld":"com"},"ip":{"addr":"185.26.238.176","port":80,"asn":9009,"as":"M247 Europe SRL","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-04T00:03:37.659Z","timestamp":1785801817659,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: verification-salesforce.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 502 Bad Gateway\r\nServer: nginx/1.30.3\r\nDate: Tue, 04 Aug 2026 00:03:37 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 15\r\nConnection: keep-alive\r\nCache-Control: no-store, no-cache, must-revalidate, max-age=0\r\nPragma: no-cache\r\nExpires: 0\r\nSurrogate-Control: no-store\r\n\r\n","headers":null,"cookies":null,"status_code":"502","status_text":"Bad Gateway","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15,"size_decoded":309,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"ece4f2496fd3e47a3aec9e5f015710e5","sha1":"1a37913906e4d90313c9b89ec6cbdd853e56911d","sha256":"930cb379321f6ce3cdaf5db7d4348290945e3702b0a04cd04622e9138dc31289","sha512":"fc1aea69908a114d701ab502191adf6370ab7d26c274224200db6d52eacfec293c2dd633224cdb45cc92eef9f37df139b4d2852adac5f44026e0d935373f310a","ssdeep":"","tlshash":"c4600030c3003c3030cf330cc00000000000cc0000000c00000ccc0c0000c0c000c3c3","first_seen":"2023-11-07T18:17:21Z","last_seen":"2026-08-04T00:04:04.259661Z","times_seen":11,"resource_available":true,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":92,"connect":25,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-03","alert":"Sinkholed","trigger":"verification-salesforce.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"verification-salesforce.com/favicon.ico","fqdn":"verification-salesforce.com","domain":"verification-salesforce.com","tld":"com"},"ip":{"addr":"185.26.238.176","port":80,"asn":9009,"as":"M247 Europe SRL","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://verification-salesforce.com/","date":"2026-08-04T00:03:37.974Z","timestamp":1785801817974,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: verification-salesforce.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://verification-salesforce.com/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx/1.30.3\r\nDate: Tue, 04 Aug 2026 00:03:37 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nContent-Length: 289\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx:1.30.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":289,"size_decoded":464,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a72b096b47d43a7fc8995be1b3bcf2bd","sha1":"d64dbe8f9094f5597f986680761d2a4934feecaa","sha256":"f53ed65771688ec45b5d9683097b5892fe790b041e244416b563407fcff3b30a","sha512":"82ffc46dd136b6d33d0911717a1e8716abbb68d6210fa16f2d35c7b832016e434bd83850f961c868bbef4407645deb99fc41b37b4c5d7ac2c5636c22835e2ae8","ssdeep":"","tlshash":"aed0ebdf5043628b0813117039c221c2334c13faa43bc6e82c83d887029863ece8baac","first_seen":"2026-08-04T00:04:04.263091Z","last_seen":"2026-08-04T00:04:04.263091Z","times_seen":1,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-03","alert":"Sinkholed","trigger":"verification-salesforce.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}