{"report_id":"25d1f21f-77dc-4649-a6c2-6808b94c0cde","version":6,"status":"done","tags":[],"date":"2026-03-22T12:56:10Z","url":{"schema":"http","addr":"acir.postofficeweb.com","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"ip":{"addr":"44.255.152.161","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"acir.postofficeweb.com/","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"title":"acir.postofficeweb.com/","dom":{"size":2294,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"a03955f9efecb90b9664f9121a988919","sha1":"fe271d37475bf53bbc08070295fbdff8db0dbde8","sha256":"e7fd2efff4e518a6697abe5ca97f1519c7372785925179c27cc5e8ab942396e7","sha512":"7e581687623de9d659cfaf7a15d2f3cbd74d0f9510d2e1907d88e3616888f4b888a44949d83cad10b928b74fd01673185a2b98f01c95ad14635ea34b3785209a","ssdeep":"","tlshash":"f34113a985b7009274a6aaed37b63f091614c403c206cd587bed666cdf85ca5ceb374c","dom_hash":"domhash79c0f064411548aed231d273d6e485cb","first_seen":"2026-03-15T22:13:26.218463Z","last_seen":"2026-08-06T12:32:29.251211Z","times_seen":14,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"acir.postofficeweb.com","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"ip":{"addr":"44.255.152.161","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-26T12:56:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-22","alert":"Phishing Block","trigger":"acir.postofficeweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"acir.postofficeweb.com","ip":{"addr":"44.255.152.161","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2016-01-31","domain_rank":0,"first_seen":"2023-04-03T22:51:18Z","last_seen":"2026-02-01T09:51:43.787804Z","alert_count":20,"request_count":5,"received_data":57949,"sent_data":2378,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"acir.postofficeweb.com/","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"ip":{"addr":"44.255.152.161","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-22T12:55:48.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: acir.postofficeweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 12:55:49 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 2284\r\nserver: nginx\r\ncache-control: no-store\r\npragma: no-cache\r\ncontent-security-policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.ironscales.com *.eu.pendo.io *.pendo.io *.googletagmanager.com *.google-analytics.com *.googleapis.com *.google.com *.gstatic.com *.statuspage.io *.sentry-cdn.com code.jquery.com cdn.jsdelivr.net appsforoffice.microsoft.com d.bablic.com staticmediafiles.s3.amazonaws.com platform.instagram.com wwwimages.adobe.com ajax.aspnetcdn.com cdnjs.cloudflare.com/ajax/libs/select2/4.0.5/js/select2.min.js; media-src * blob:; default-src 'self'; img-src * data: blob:; object-src 'self' ironscales-deepfake-production.s3.amazonaws.com; connect-src * webpack:; font-src *; style-src * 'unsafe-inline'; frame-src 'self' *.google.com ironscales.com *.ironscales.com *.eu.pendo.io *.pendo.io *.youtube.com 4hyb9xl50gtg.statuspage.io ironscales-deepfake-production.s3.amazonaws.com\r\nvary: Cookie\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2284,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0314f72f5f010e0e37246ed2333e3bd3","sha1":"d1f658b513133d731be40411dae388f362f82000","sha256":"a532122f587332b89b860b4d0ffb086d7d9deb1802e1175217cafdd3c654c12f","sha512":"937ee06a9355bd5fe5406edd2e303ec2ee159b74899ee7a9ca8f28f443018d2d587b2caa6ee79cb74412891667e235aff7b90e2476257d2934bc3e7c183a85e6","ssdeep":"","tlshash":"ba41415986b74191b496a6fd37763f0a1218c403c206cd5877ed666cdf81ca68eb738c","first_seen":"2024-08-19T22:42:42.13263Z","last_seen":"2026-08-06T12:32:29.252871Z","times_seen":15,"resource_available":true,"data":null}},"time_used":1402,"timings":{"blocked":605,"dns":75,"connect":174,"send":0,"wait":190,"receive":1,"ssl":354},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-22","alert":"Phishing Block","trigger":"acir.postofficeweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"acir.postofficeweb.com/static/stub-pages/images/company-logo.png","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"ip":{"addr":"44.255.152.161","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://acir.postofficeweb.com/","date":"2026-03-22T12:55:49.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /static/stub-pages/images/company-logo.png HTTP/1.1\r\nHost: acir.postofficeweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://acir.postofficeweb.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 12:55:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 4265\r\nserver: nginx\r\nlast-modified: Thu, 19 Mar 2026 07:45:17 GMT\r\netag: \"69bba98d-10a9\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4265,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 161 x 46, 8-bit/color RGBA, non-interlaced","md5":"6194e20f07afd7b29656eb309f40098e","sha1":"472bcba130212a893a554924b8869ae222fd6a3b","sha256":"a7ce8a30fff8291a75a30b5a03b46283d11e3b68652b2522f168cb0d1055800f","sha512":"b300e1610223cb4b84f491678ecfe2968fce7002792fc0d79116fd8f0a4596270d44224db787d4b40428ed008799863985f3a60da08a751b207afb28806cd491","ssdeep":"96:rS5qB+01BmjN9Ku4GYBEygoiZIpqBPvNPvBG:rSsJsjNEurY2yFiZIpYPvFg","tlshash":"c6918e9e9f194e83852f1cfa563e4ec1110e93ce1e5091d0b63b74d4ff2c647642a589","first_seen":"2023-10-24T11:27:59Z","last_seen":"2026-08-06T12:32:29.253841Z","times_seen":17,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":183,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-22","alert":"Phishing Block","trigger":"acir.postofficeweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"acir.postofficeweb.com/static/stub-pages/images/background.svg","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"ip":{"addr":"44.255.152.161","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://acir.postofficeweb.com/","date":"2026-03-22T12:55:49.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /static/stub-pages/images/background.svg HTTP/1.1\r\nHost: acir.postofficeweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://acir.postofficeweb.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 12:55:49 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 836\r\nserver: nginx\r\nlast-modified: Thu, 19 Mar 2026 07:45:17 GMT\r\netag: \"69bba98d-344\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":836,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"664a11769a3459d0f2370367ff127e00","sha1":"7a314107b6ee56aff7805d7774bf361b17281845","sha256":"94750be824a74f88a29514964cf284bbfd6746f426aec8952291ff401c94a6af","sha512":"9c03af91ae9ac996a1ba538cbeeb73768fc86c4790d1fb96f89300fc63b8f62f3694ee12ea25a7d13e8d4c178f6d48eaf40c59f570fc20b1c7d3413b9be78e3c","ssdeep":"","tlshash":"8801c23eb2cdc421c3a842995d0c94951346c0eac9dad075d3d2bb5f3c2c5d35d182d5","first_seen":"2023-10-24T11:27:59Z","last_seen":"2026-08-06T12:32:29.25586Z","times_seen":17,"resource_available":false,"data":null}},"time_used":528,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":528,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-22","alert":"Phishing Block","trigger":"acir.postofficeweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"acir.postofficeweb.com/static/training/img/domain-image.svg","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"ip":{"addr":"44.255.152.161","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://acir.postofficeweb.com/","date":"2026-03-22T12:55:49.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /static/training/img/domain-image.svg HTTP/1.1\r\nHost: acir.postofficeweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://acir.postofficeweb.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 22 Mar 2026 12:55:49 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 46978\r\nserver: nginx\r\nlast-modified: Thu, 19 Mar 2026 07:45:18 GMT\r\netag: \"69bba98e-b782\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46978,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c8e85764c0d2f31fb833ed17382d2f7f","sha1":"52ff400a78cbcde80925e0289203e6d619f399be","sha256":"a48c2a9518ca07ff032cbf38852ce60eafcbcad755fafe79eac12c7e6223cccf","sha512":"ff72b40c6e153d3efd099567fcb779a4cce0c008f687c77d6fd50c7512512425fbfdef2e0f5de9c4d6acb69e91ca699d61a6f2dcd9b5a4e4bfa8eb1f824ec8ac","ssdeep":"768:XsBkTXgtSZ9pRi0g4ZEZqv5dSLlx+xZJIBXIcU6bjSeBpsnW2cflWIx2w+HBo:cCtv20geYo4rUZGBYcU63KW2sgdo","tlshash":"8e2395dd2f308ee54dce87cbbf21209dad1bc0aa59858b54c05d9f1d24c6c6d9e89e83","first_seen":"2023-10-24T11:27:59Z","last_seen":"2026-08-06T12:32:29.254975Z","times_seen":18,"resource_available":false,"data":null}},"time_used":529,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":354,"receive":175,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-22","alert":"Phishing Block","trigger":"acir.postofficeweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"acir.postofficeweb.com/favicon.ico","fqdn":"acir.postofficeweb.com","domain":"postofficeweb.com","tld":"com"},"ip":{"addr":"44.255.152.161","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://acir.postofficeweb.com/","date":"2026-03-22T12:55:50.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: acir.postofficeweb.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://acir.postofficeweb.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Sun, 22 Mar 2026 12:55:50 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-12T08:40:34.234906Z","times_seen":549669,"resource_available":true,"data":null}},"time_used":180,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-22","alert":"Sinkholed","trigger":"acir.postofficeweb.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-22","alert":"Phishing Block","trigger":"acir.postofficeweb.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}