{"report_id":"198ae601-378f-488a-a2f9-0abe44455e44","version":0,"status":"done","tags":["microsoft","phishing"],"date":"2026-10-06T22:41:52Z","url":{"schema":"https","addr":"notifications.microsoft-ssl.com/","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"52.32.114.43","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"title":"Sign in to your account","dom":{"size":2638,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"21096a7c5d550d30058141b601bc2a47","sha1":"1c6bc38831424034e37e7dc081567dd4724ce4bd","sha256":"2ca285cd0ba97a22d31315ae20656788d3b4801be13e951e38865754ee5fa418","sha512":"3c31a2ce49947e4c1584367214489808ec9007e9cf33d83ddb4e41a80803a019619793d05a897a9daf3c152b3994660601465cb0c1c913da463ed36078400b60","ssdeep":"","tlshash":"1151d12180f50a631143c49439e2ad2b7ed4da034b4b59053aec8ed97fd3e86cea7699","dom_hash":"domhashc41a3609cf844ec514c20f9714d15a7c","first_seen":"2026-09-04T20:09:07.374416Z","last_seen":"2026-10-06T22:41:53.730967Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"52.32.114.43","port":0,"asn":16509,"as":"Amazon.com, Inc.","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-10T22:41:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"notifications.microsoft-ssl.com","ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2024-09-04","domain_rank":0,"first_seen":"2026-09-04T20:09:03.538067Z","last_seen":"2026-10-06T21:27:07.147196Z","alert_count":28,"request_count":7,"received_data":18341,"sent_data":3655,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"c91d6a1a2ca1005549147234afcc2dde","sha1":"3df8dd7ca4d115996a562f44e25ca742836292fd","sha256":"2f3bf20ae460cfb67a9bf3dc53a92ca45d1423caaf89cb507ba1b54211237a0d","sha512":"764237338608c642c42f1766d9b7b87f299faa46f3c0615ddc6dd859c790e8fe0523d9d14e51ccbc072cffaab9c5c17fdfd7b5fba0f49c1a9593950dc70d4bc8","ssdeep":"","tlshash":"5b700000b0802a22aa03a00a0222203300fa0e020bc00008002302228c322a022220ca","size":23,"data":"","first_seen":"2026-09-04T20:09:07.394237Z","last_seen":"2026-10-06T22:41:53.748943Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/script.js","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8719ec7864ca68cc3978a7390d2d6b6","sha1":"e9cd657abc2a3c1a07490d306912bfd3045149f4","sha256":"5e524b3606889008a31098d38bdee504079ddb3d524efabeb081937cca424d93","sha512":"ec39eaf86d78b6f4ae553cbd42c30364859f671e7eed3e8acc94b73a0ce804f3f7cc08f07f20e554f3b8f58e25a604e3a90bfc50417fa462c7b5d199b3e1ccbf","ssdeep":"96:+Rp8PAS0ZdPTdoPGr6SI2D7rJI+DspEr++TI1zhz4M7OZnKdxL1IbJI37cLiriSg:+Rp8PAS0Zd7doPFSI2DxI+Dsp2TIjIZp","tlshash":"e3b1526a75da1c32506768f2802b12b93630d5113443e192763cc7a91f36d6bd73bbeb","size":5330,"data":"","first_seen":"2026-09-04T20:09:07.385278Z","last_seen":"2026-10-06T22:41:53.740209Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Field:home","filename":"https://notifications.microsoft-ssl.com/script.js","line_number":97,"column_number":11},{"level":"log","text":"Value:","filename":"https://notifications.microsoft-ssl.com/script.js","line_number":98,"column_number":11},{"level":"log","text":"Screen:username","filename":"https://notifications.microsoft-ssl.com/script.js","line_number":99,"column_number":11},{"level":"log","text":"Timestamp:2026-10-06 22:39:20","filename":"https://notifications.microsoft-ssl.com/script.js","line_number":100,"column_number":11},{"level":"log","text":"","filename":"https://notifications.microsoft-ssl.com/script.js","line_number":111,"column_number":17}]},"http":[{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-06T22:39:19.335Z","timestamp":1791326359335,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.microsoft-ssl.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 07 Jul 2026 00:00:00 GMT","end":"Wed, 20 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"52:CF:6A:F2:A1:FB:C4:43:DA:07:CF:23:B9:03:B9:3B:84:6C:32:D6","sha256":"FC:97:12:E1:1D:E7:81:5D:FF:79:77:BB:15:B2:DC:33:EF:3F:FD:86:86:DB:47:CB:CE:DC:22:AB:43:EE:CF:B7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: notifications.microsoft-ssl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 06 Oct 2026 22:39:19 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 848\r\nserver: Apache\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2785,"size_decoded":1044,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"f5d67001ed6ed0e20c149a8b28335258","sha1":"f54667551b0aa3e88bf3d992eb59c3b9678aab6c","sha256":"6e62922dc309bcbca8f50115e67d6fd7493fd9ca1443a33f40641435c4488d2d","sha512":"c54d25a525e71f4a38be669e979b1e563e95e70f7c1411a98d3e14f1a9e5eca02915f2f9f4ad22652fd44d5b847a017a769d4dbf045d0154485d4520012b4907","ssdeep":"","tlshash":"9051e21590f649630142849439e2ad2b7ee4d6034b4b59053aec8ed53fd3e86cea7658","first_seen":"2026-09-04T20:09:07.378056Z","last_seen":"2026-10-06T22:41:53.734782Z","times_seen":3,"resource_available":true,"data":null}},"time_used":720,"timings":{"blocked":-1,"dns":38,"connect":168,"send":0,"wait":169,"receive":0,"ssl":345},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/style.css","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://notifications.microsoft-ssl.com/","date":"2026-10-06T22:39:20.281Z","timestamp":1791326360281,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.microsoft-ssl.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 07 Jul 2026 00:00:00 GMT","end":"Wed, 20 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"52:CF:6A:F2:A1:FB:C4:43:DA:07:CF:23:B9:03:B9:3B:84:6C:32:D6","sha256":"FC:97:12:E1:1D:E7:81:5D:FF:79:77:BB:15:B2:DC:33:EF:3F:FD:86:86:DB:47:CB:CE:DC:22:AB:43:EE:CF:B7"}}},"request":{"raw":"GET /style.css HTTP/1.1\r\nHost: notifications.microsoft-ssl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://notifications.microsoft-ssl.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 06 Oct 2026 22:39:20 GMT\r\ncontent-type: text/css\r\ncontent-length: 1096\r\nserver: Apache\r\nlast-modified: Wed, 02 Oct 2024 16:25:28 GMT\r\netag: \"cb4-62380e2cbb2fc-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3252,"size_decoded":1377,"mime_type":"text/css","magic":"ASCII text, with very long lines (519)","md5":"daf99d1174a126ed3cd1bbc36b5e0313","sha1":"fd970ce3a0d3bfd8e01309da41535a3057066eaa","sha256":"91ce5949f96a86e2bf50ff71c92f163a36451907df7255c5ddabbca86bd058fe","sha512":"86ebeeda7361bd7ed5ef86f3847dd91a5bc9fd2088c093725f728fb86ef44795e695b390f50c7c2d1cd55cbca23d05efcb242d2105b89d7aa63f271a674f9ae6","ssdeep":"","tlshash":"e061f1e6aa530847e656e0582fb6cb5033995183c04ede7f3f98325ccf8e2d455a279c","first_seen":"2026-09-04T20:09:07.381682Z","last_seen":"2026-10-06T22:41:53.736973Z","times_seen":3,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/script.js","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://notifications.microsoft-ssl.com/","date":"2026-10-06T22:39:20.287Z","timestamp":1791326360287,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.microsoft-ssl.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 07 Jul 2026 00:00:00 GMT","end":"Wed, 20 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"52:CF:6A:F2:A1:FB:C4:43:DA:07:CF:23:B9:03:B9:3B:84:6C:32:D6","sha256":"FC:97:12:E1:1D:E7:81:5D:FF:79:77:BB:15:B2:DC:33:EF:3F:FD:86:86:DB:47:CB:CE:DC:22:AB:43:EE:CF:B7"}}},"request":{"raw":"GET /script.js HTTP/1.1\r\nHost: notifications.microsoft-ssl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://notifications.microsoft-ssl.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 06 Oct 2026 22:39:20 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 1552\r\nserver: Apache\r\nlast-modified: Wed, 02 Oct 2024 16:39:01 GMT\r\netag: \"14d2-62381134ef135-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5330,"size_decoded":1841,"mime_type":"text/javascript","magic":"ASCII text","md5":"e8719ec7864ca68cc3978a7390d2d6b6","sha1":"e9cd657abc2a3c1a07490d306912bfd3045149f4","sha256":"5e524b3606889008a31098d38bdee504079ddb3d524efabeb081937cca424d93","sha512":"ec39eaf86d78b6f4ae553cbd42c30364859f671e7eed3e8acc94b73a0ce804f3f7cc08f07f20e554f3b8f58e25a604e3a90bfc50417fa462c7b5d199b3e1ccbf","ssdeep":"96:+Rp8PAS0ZdPTdoPGr6SI2D7rJI+DspEr++TI1zhz4M7OZnKdxL1IbJI37cLiriSg:+Rp8PAS0Zd7doPFSI2DxI+Dsp2TIjIZp","tlshash":"e3b1526a75da1c32506768f2802b12b93630d5113443e192763cc7a91f36d6bd73bbeb","first_seen":"2026-09-04T20:09:07.385278Z","last_seen":"2026-10-06T22:41:53.740209Z","times_seen":3,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/microsoft-logo.svg","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://notifications.microsoft-ssl.com/","date":"2026-10-06T22:39:20.291Z","timestamp":1791326360291,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.microsoft-ssl.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 07 Jul 2026 00:00:00 GMT","end":"Wed, 20 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"52:CF:6A:F2:A1:FB:C4:43:DA:07:CF:23:B9:03:B9:3B:84:6C:32:D6","sha256":"FC:97:12:E1:1D:E7:81:5D:FF:79:77:BB:15:B2:DC:33:EF:3F:FD:86:86:DB:47:CB:CE:DC:22:AB:43:EE:CF:B7"}}},"request":{"raw":"GET /microsoft-logo.svg HTTP/1.1\r\nHost: notifications.microsoft-ssl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://notifications.microsoft-ssl.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 06 Oct 2026 22:39:20 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 3651\r\nserver: Apache\r\nlast-modified: Wed, 02 Oct 2024 14:16:46 GMT\r\netag: \"e43-6237f168fe516\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3651,"size_decoded":3885,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ee5c8d9fb6248c938fd0dc19370e90bd","sha1":"d01a22720918b781338b5bbf9202b241a5f99ee4","sha256":"04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a","sha512":"c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58","ssdeep":"","tlshash":"6371117b132887dae9d4a78c2e997b8d377095c4b1b24290874328a5bc086f7f038d60","first_seen":"2023-04-06T08:44:24Z","last_seen":"2026-10-11T12:14:19.141884Z","times_seen":129494,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/signin-options_key.svg","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://notifications.microsoft-ssl.com/","date":"2026-10-06T22:39:20.293Z","timestamp":1791326360293,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.microsoft-ssl.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 07 Jul 2026 00:00:00 GMT","end":"Wed, 20 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"52:CF:6A:F2:A1:FB:C4:43:DA:07:CF:23:B9:03:B9:3B:84:6C:32:D6","sha256":"FC:97:12:E1:1D:E7:81:5D:FF:79:77:BB:15:B2:DC:33:EF:3F:FD:86:86:DB:47:CB:CE:DC:22:AB:43:EE:CF:B7"}}},"request":{"raw":"GET /signin-options_key.svg HTTP/1.1\r\nHost: notifications.microsoft-ssl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://notifications.microsoft-ssl.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 06 Oct 2026 22:39:20 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1592\r\nserver: Apache\r\nlast-modified: Wed, 02 Oct 2024 16:25:28 GMT\r\netag: \"638-62380e2d8267c\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1592,"size_decoded":1826,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4e48046ce74f4b89d45037c90576bfac","sha1":"4a41b3b51ed787f7b33294202da72220c7cd2c32","sha256":"8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93","sha512":"b2bba2a68edaa1a08cfa31ed058afb5e6a3150aabb9a78db9f5ccc2364186d44a015986a57707b57e2cc855fa7da57861ad19fc4e7006c2c239c98063fe903cf","ssdeep":"","tlshash":"b931787f43b45ae7239017741760626c13f4ee917169d0b4dba30c9a8d4bd33327843a","first_seen":"2023-04-14T20:16:11Z","last_seen":"2026-10-11T12:14:19.129679Z","times_seen":93982,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/favicon.ico","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://notifications.microsoft-ssl.com/","date":"2026-10-06T22:39:20.603Z","timestamp":1791326360603,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.microsoft-ssl.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 07 Jul 2026 00:00:00 GMT","end":"Wed, 20 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"52:CF:6A:F2:A1:FB:C4:43:DA:07:CF:23:B9:03:B9:3B:84:6C:32:D6","sha256":"FC:97:12:E1:1D:E7:81:5D:FF:79:77:BB:15:B2:DC:33:EF:3F:FD:86:86:DB:47:CB:CE:DC:22:AB:43:EE:CF:B7"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: notifications.microsoft-ssl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://notifications.microsoft-ssl.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Tue, 06 Oct 2026 22:39:20 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 196\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":196,"size_decoded":350,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"62962daa1b19bbcc2db10b7bfd531ea6","sha1":"d64bae91091eda6a7532ebec06aa70893b79e1f8","sha256":"80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880","sha512":"9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7","ssdeep":"","tlshash":"c0d0129e9183638b442225907ac211d2654d13a6b87645e82d82a48a951857dc5ca69d","first_seen":"2023-03-07T12:06:54Z","last_seen":"2026-10-11T12:46:45.929219Z","times_seen":115010,"resource_available":true,"data":null}},"time_used":171,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"notifications.microsoft-ssl.com/db_insert.php","fqdn":"notifications.microsoft-ssl.com","domain":"microsoft-ssl.com","tld":"com"},"ip":{"addr":"16.145.19.199","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://notifications.microsoft-ssl.com/","date":"2026-10-06T22:39:20.630Z","timestamp":1791326360630,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.microsoft-ssl.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 07 Jul 2026 00:00:00 GMT","end":"Wed, 20 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"52:CF:6A:F2:A1:FB:C4:43:DA:07:CF:23:B9:03:B9:3B:84:6C:32:D6","sha256":"FC:97:12:E1:1D:E7:81:5D:FF:79:77:BB:15:B2:DC:33:EF:3F:FD:86:86:DB:47:CB:CE:DC:22:AB:43:EE:CF:B7"}}},"request":{"raw":"POST /db_insert.php HTTP/1.1\r\nHost: notifications.microsoft-ssl.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-type: application/x-www-form-urlencoded\r\nContent-Length: 105\r\nOrigin: https://notifications.microsoft-ssl.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://notifications.microsoft-ssl.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":105,"data":"sessionID=knlzbm\u0026screen=username\u0026username=\u0026password=\u0026otp=\u0026field=home\u0026value=\u0026timestamp=2026-10-06 22:39:20"}},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 06 Oct 2026 22:39:20 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":828,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T12:43:34.847605Z","times_seen":19027197,"resource_available":true,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"notifications.microsoft-ssl.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"notifications.microsoft-ssl.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}