{"report_id":"2ebd601a-f5d3-4180-bcac-5f1a07b58b50","version":0,"status":"done","tags":[],"date":"2026-07-22T21:49:48Z","url":{"schema":"https","addr":"sephoras.org/","fqdn":"sephoras.org","domain":"sephoras.org","tld":"org"},"ip":{"addr":"103.101.85.123","port":0,"asn":200239,"as":"Bogahost Bilisim ve Telekomunikasyon Hiz. San ve Tic. Ltd. Sti.","country":"Türkiye","country_code":"TR"},"final":{"url":{"schema":"https","addr":"sephoras.org/","fqdn":"sephoras.org","domain":"sephoras.org","tld":"org"},"title":"SEPHORA: makeup, perfume, care and beauty","dom":{"size":1961534,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"00d88071edc5977439dc9c158857225b","sha1":"aca4e5e1465127d9ee3543361a42ed051decb92e","sha256":"23b948e22e2bd30bb8bb849d625786965fe978f4618bdd50eac6cde09cb54ef8","sha512":"ab1c651fbcb1ba032829aa72eda43b3f5583238c2d9f0afeea1e97dcdf69309fae30c1236990cc9f73b3e16d3e314c513d104f96fb1ad05278d140bec606c7b9","ssdeep":"12288:kSrca3+zQF7ASLlsat3fSDtbYGGxRekZwn7SnQUMEiZVAI0JewJn3bY5FhrsJa9Q:TFfF3WbmndZw7Snn5uVjz4n3bY5tAV","tlshash":"d6952b3c36f00276019b41bdfba69b169e8c8d0fc357ec52f69d03925fa9c519a47a8c","dom_hash":"domhash672b9e315567a8900330f07b8376fd34","first_seen":"2026-07-22T21:49:52.443116Z","last_seen":"2026-07-22T21:49:52.443116Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"sephoras.org/","fqdn":"sephoras.org","domain":"sephoras.org","tld":"org"},"ip":{"addr":"103.101.85.123","port":0,"asn":200239,"as":"Bogahost Bilisim ve Telekomunikasyon Hiz. San ve Tic. Ltd. Sti.","country":"Türkiye","country_code":"TR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-26T21:49:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"sephoras.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"sephoras.org","ip":{"addr":"103.101.85.123","port":443,"asn":200239,"as":"Bogahost Bilisim ve Telekomunikasyon Hiz. San ve Tic. Ltd. Sti.","country":"Türkiye","country_code":"TR"},"domain_registered":"2026-06-18","domain_rank":0,"first_seen":"2026-07-22T21:49:48.792616Z","last_seen":"2026-07-22T21:49:48.792616Z","alert_count":2,"request_count":2,"received_data":3881261,"sent_data":965,"comment":"","tags":null,"fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"sephoras.org/","fqdn":"sephoras.org","domain":"sephoras.org","tld":"org"},"ip":{"addr":"103.101.85.123","port":443,"asn":200239,"as":"Bogahost Bilisim ve Telekomunikasyon Hiz. San ve Tic. Ltd. Sti.","country":"Türkiye","country_code":"TR"},"introduction_type":"scriptElement","is_inline":true,"md5":"462e3274c481be2c3f46de2c0e7d0665","sha1":"0db8b541fbbfe0e4dc120508841487885a6c6ff2","sha256":"90f7cdfbaa480778bdf6971f82f073ff4a2b6574b7296e6bebc97014ce8ee372","sha512":"da124c85b3a2c0b1ae7f61dd92dba717adcc7ffd8765bda92dc8fb5f0238afece0dd3faa2f09ffcff2f9b858181264429be9fc7854daa7d0a64b84af916d85af","ssdeep":"96:mUBJFNrMFvCGrxReH3QeChXoeXDLjrKHv3ZPpeOyeD9NlWNlj6VxggoMOxHHW5H:m2lrKxrxeQeGYeDLyHvp3yeD9NYNF6VL","tlshash":"e8a1109ebea211b1c0b3b8ba83df56043737616b114ac80679bc46d04fe4e14356eafc","size":4875,"data":"","first_seen":"2026-07-22T21:49:52.449676Z","last_seen":"2026-07-22T21:49:52.449676Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sephoras.org/private-sales-banner-hero.png","fqdn":"sephoras.org","domain":"sephoras.org","tld":"org"},"ip":{"addr":"103.101.85.123","port":443,"asn":200239,"as":"Bogahost Bilisim ve Telekomunikasyon Hiz. San ve Tic. Ltd. Sti.","country":"Türkiye","country_code":"TR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sephoras.org/","date":"2026-07-22T21:49:18.444Z","timestamp":1784756958444,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sephoras.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 21 Jun 2026 16:51:51 GMT","end":"Sat, 19 Sep 2026 16:51:50 GMT"},"fingerprint":{"sha1":"19:C2:B7:F5:BE:A9:40:DF:92:B6:2E:A2:86:D1:4E:97:CF:FF:E1:23","sha256":"2E:6F:44:E4:07:4A:D2:2C:87:E2:CE:77:DE:A8:5F:01:56:D6:BB:26:4F:D3:ED:6F:76:AC:95:1D:FE:E0:19:67"}}},"request":{"raw":"GET /private-sales-banner-hero.png HTTP/1.1\r\nHost: sephoras.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx/1.18.0 (Ubuntu)\r\ndate: Wed, 22 Jul 2026 21:49:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 1630027\r\nlast-modified: Sun, 21 Jun 2026 17:44:34 GMT\r\netag: \"6a382302-18df4b\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1630027,"size_decoded":1630273,"mime_type":"image/png","magic":"PNG image data, 2880 x 892, 8-bit/color RGB, non-interlaced","md5":"57276abab7c875a957f7301e0d10c1e1","sha1":"ec5e1ffcbb5086c434a31511a66469005ca82647","sha256":"30b63ef51363549618c37affb4fab956ae0877407b88cd80957f715c0f0abb87","sha512":"3d1c3dc867e715698e5646430233cffbd0f3193fca62010eed48e1ed053f5647d21acb38a435cac5291f70fa62bfe10107f0ac03b1b5dd18a1bfeb75b8972055","ssdeep":"24576:F6OiWresDyBAUCSYqQNqWwVy9p28wLHzJtNtDWzBHsf3pgYm0NI:FhisxefVyz28MJtNtABHsf3pg70O","tlshash":"f52533577b524a1d48b26e34e4ff5a8ab735241b95cb0e0d3ec28d0cd642642f6293ee","first_seen":"2026-07-22T21:49:52.44705Z","last_seen":"2026-07-22T21:49:52.44705Z","times_seen":1,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"sephoras.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sephoras.org/","fqdn":"sephoras.org","domain":"sephoras.org","tld":"org"},"ip":{"addr":"103.101.85.123","port":443,"asn":200239,"as":"Bogahost Bilisim ve Telekomunikasyon Hiz. San ve Tic. Ltd. Sti.","country":"Türkiye","country_code":"TR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-22T21:49:17.955Z","timestamp":1784756957955,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sephoras.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 21 Jun 2026 16:51:51 GMT","end":"Sat, 19 Sep 2026 16:51:50 GMT"},"fingerprint":{"sha1":"19:C2:B7:F5:BE:A9:40:DF:92:B6:2E:A2:86:D1:4E:97:CF:FF:E1:23","sha256":"2E:6F:44:E4:07:4A:D2:2C:87:E2:CE:77:DE:A8:5F:01:56:D6:BB:26:4F:D3:ED:6F:76:AC:95:1D:FE:E0:19:67"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: sephoras.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx/1.18.0 (Ubuntu)\r\ndate: Wed, 22 Jul 2026 21:49:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 26 Jun 2026 13:19:27 GMT\r\netag: W/\"6a3e7c5f-22580b\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.18.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":2250763,"size_decoded":743908,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"0a39470d22e7f07e291c3322942060fa","sha1":"615e8ea88f0c6a59bbec4e96d5c1d9d31b8a9de6","sha256":"176ffdd7a13d67d8ddf08dd0dbb74c114d3759dff1ec44d34a55c6b85bd9b99b","sha512":"0e8a156bb5b8a25042e211f5ea55892a83203728b4418ce4897b6eb09eae753893338d15c30a472f7932147e97a552281cd70e079f0bfffc7e2bd7f3a728def1","ssdeep":"6144:MSdNca3F8zmbRRLFyRetAoFLls6Ct3fU1:MSrca3+zQF5AWLls7t3f6","tlshash":"ef25631d2bb403b5119f01beebb79716ea8c9c4fe357fc41f5ad03824f688614696a8c","first_seen":"2026-07-22T21:49:52.448185Z","last_seen":"2026-07-22T21:49:52.448185Z","times_seen":1,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":68,"connect":43,"send":0,"wait":43,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-22","alert":"Sinkholed","trigger":"sephoras.org","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}