{"report_id":"3a29e247-fac2-4dd2-bd99-2dfbd0acc60f","version":6,"status":"done","tags":[],"date":"2026-01-13T05:19:20Z","url":{"schema":"https","addr":"web04zoom.im","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"ip":{"addr":"89.163.155.33","port":0,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"web04zoom.im/Windows/invite.php","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"title":"Download Zoom","dom":{"size":5144,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"430f2c0d77ed928cf9ae2adba2ea7e33","sha1":"c1f3ecb70c92b6996481f49ac4ead34ae2b8402c","sha256":"8d6aeec2c84a1acc4e845c74677e9f97dddbccb377b1a36d6d8fe65c1321d4e8","sha512":"18ed38c8711003716d83e0d6a16c6d44ca7f9864dafbc742abace3275953453ebf3183fbc722e521648ffa0f11cb2800b02d7724b018c399074fa7336278701c","ssdeep":"96:nWkRlxGZw7N0wMbFalziVJmFyG7m6Lwhh+3:WkLkeyxawVJayGSHu","tlshash":"5eb1858b45f3120b4a03f5a86fba6b0866a3d087d54ded483eac029dcf84a44c5837ce","dom_hash":"domhash6b628f5ec3aff1f5060b2d1345246feb","first_seen":"2026-01-13T05:19:42.585668Z","last_seen":"2026-01-13T05:19:42.585668Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"web04zoom.im","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"ip":{"addr":"89.163.155.33","port":0,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-17T05:19:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":0,"analyzer":2}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-13T05:19:05Z","timestamp":1768281545,"ip_dst":{"addr":"94.139.32.21","port":443,"asn":0,"as":"","country":"France","country_code":"FR"},"ip_src":{"addr":"Client IP","port":60996,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO File Sharing Related Domain in TLS SNI (gofile .io)","source":"{\"timestamp\":\"2026-01-13T05:19:05.229687+0000\",\"flow_id\":359174521783292,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":60996,\"dest_ip\":\"94.139.32.21\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2049323,\"rev\":1,\"signature\":\"ET INFO File Sharing Related Domain in TLS SNI (gofile .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2023_11_28\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_11_28\"]}},\"tls\":{\"sni\":\"cold-na-phx-4.gofile.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":789,\"bytes_toclient\":2702,\"start\":\"2026-01-13T05:19:04.885756+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-13T05:19:05Z","timestamp":1768281545,"ip_dst":{"addr":"94.139.32.31","port":443,"asn":0,"as":"","country":"France","country_code":"FR"},"ip_src":{"addr":"Client IP","port":58722,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO File Sharing Related Domain in TLS SNI (gofile .io)","source":"{\"timestamp\":\"2026-01-13T05:19:05.772776+0000\",\"flow_id\":1750494817654484,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.49\",\"src_port\":58722,\"dest_ip\":\"94.139.32.31\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2049323,\"rev\":1,\"signature\":\"ET INFO File Sharing Related Domain in TLS SNI (gofile .io)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2023_11_28\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2023_11_28\"]}},\"tls\":{\"sni\":\"cold-na-phx-9.gofile.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":789,\"bytes_toclient\":1654,\"start\":\"2026-01-13T05:19:05.431828+0000\"}}"}],"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"cold-na-phx-4.gofile.io","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"cold-na-phx-9.gofile.io","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"cold-na-phx-9.gofile.io","ip":{"addr":"94.139.32.31","port":443,"asn":0,"as":"","country":"France","country_code":"FR"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":2846,"sent_data":562,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"web04zoom.im","ip":{"addr":"89.163.155.33","port":443,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":5,"received_data":19450,"sent_data":2515,"comment":"","tags":null,"fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"st2.zoom.us","ip":{"addr":"170.114.45.1","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":71283,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":2288,"sent_data":465,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"toolbox.marketingtools.apple.com","ip":{"addr":"17.33.192.145","port":443,"asn":714,"as":"APPLE-ENGINEERING","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":287040,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":11847,"sent_data":499,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"tools.applemediaservices.com","ip":{"addr":"17.253.142.4","port":443,"asn":714,"as":"APPLE-ENGINEERING","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":357597,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":11119,"sent_data":495,"comment":"","tags":null,"fingerprints":null},{"fqdn":"play.google.com","ip":{"addr":"172.217.19.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":48,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":5734,"sent_data":485,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cold-na-phx-4.gofile.io","ip":{"addr":"94.139.32.21","port":443,"asn":0,"as":"","country":"France","country_code":"FR"},"domain_registered":"unknown","domain_rank":6795308,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":2821,"sent_data":562,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"web04zoom.im/Windows/visit.php","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"ip":{"addr":"89.163.155.33","port":443,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-13T05:18:59.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web04zoom.im.web04zoom.us","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:41:37 GMT","end":"Sun, 12 Apr 2026 13:41:36 GMT"},"fingerprint":{"sha1":"53:9E:75:4B:7B:02:0A:57:CA:FB:93:0E:48:9A:85:BD:67:11:AE:8F","sha256":"4B:C5:87:83:3A:E3:B0:95:0D:77:28:A1:F9:8E:9B:B2:61:82:E8:88:E9:BA:6D:6D:5E:E9:69:2F:99:9C:4E:C5"}}},"request":{"raw":"GET /Windows/visit.php HTTP/1.1\r\nHost: web04zoom.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web04zoom.im/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Tue, 13 Jan 2026 05:19:00 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nlocation: invite.php\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\nalt-svc: h3=\":444\"; ma=2592000, h3-29=\":444\"; ma=2592000, h3-Q050=\":444\"; ma=2592000, h3-Q046=\":444\"; ma=2592000, h3-Q043=\":444\"; ma=2592000, quic=\":444\"; ma=2592000; v=\"43,46\"\r\nx-turbo-charged-by: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":5329,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-05T21:03:26.665966Z","times_seen":17731141,"resource_available":true,"data":null}},"time_used":431,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":431,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"st2.zoom.us/static/6.3.25699/image/new/topNav/Zoom_logo.svg","fqdn":"st2.zoom.us","domain":"zoom.us","tld":"us"},"ip":{"addr":"170.114.45.1","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web04zoom.im/Windows/invite.php","date":"2026-01-13T05:19:00.280Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.zoom.us","organization":"Zoom Communications, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 29 Dec 2025 00:00:00 GMT","end":"Tue, 29 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"43:41:3B:D9:50:C4:C8:1E:B1:C4:DA:67:B5:EB:96:BF:4A:EC:7B:AF","sha256":"09:4E:8C:85:30:0C:A1:52:37:D6:7C:A5:0A:B0:44:7D:B9:AB:37:7B:B3:E5:E5:A3:18:2C:20:9E:DC:2B:0F:D1"}}},"request":{"raw":"GET /static/6.3.25699/image/new/topNav/Zoom_logo.svg HTTP/1.1\r\nHost: st2.zoom.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web04zoom.im/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 13 Jan 2026 05:19:00 GMT\r\ncontent-type: image/svg+xml\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\nage: 1635074\r\ncache-control: public, max-age=31536000\r\netag: W/\"a28205cc5fd121cd83fb54f2447a6257\"\r\nexpires: Wed, 13 Jan 2027 05:19:00 GMT\r\nlast-modified: Sat, 14 Sep 2024 09:24:08 GMT\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\naccess-control-request-method: GET\r\ncross-origin-resource-policy: cross-origin\r\nx-amz-server-side-encryption: AES256\r\nserver: cloudflare\r\ncf-ray: 9bd26faafdeec272-OSL\r\ncontent-encoding: gzip\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1629,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a28205cc5fd121cd83fb54f2447a6257","sha1":"e71c439697074419693fadee65815f7f084dfbe0","sha256":"faae7f9ffd388a586a77086fd80d4b7a90b21c0a237769929ec4c119d487f72a","sha512":"d9eb786538e9b7d490a0f156d94fb6d620832253cbb4a14f2806bd80fbc77ea5ba49d54df948d8c27a178e1fe532718b440d17d874fe26ee44becc96e76d8986","ssdeep":"","tlshash":"7031ceeb436164a267074fd1cd29f4a16cbb2e972731a31c53f5d77230a12dab448e51","first_seen":"2023-09-22T19:45:57Z","last_seen":"2026-08-05T14:12:56.71106Z","times_seen":1794,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":35,"dns":21,"connect":1,"send":0,"wait":62,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web04zoom.im/favicon.ico","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"ip":{"addr":"89.163.155.33","port":443,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web04zoom.im/Windows/invite.php","date":"2026-01-13T05:19:00.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web04zoom.im.web04zoom.us","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:41:37 GMT","end":"Sun, 12 Apr 2026 13:41:36 GMT"},"fingerprint":{"sha1":"53:9E:75:4B:7B:02:0A:57:CA:FB:93:0E:48:9A:85:BD:67:11:AE:8F","sha256":"4B:C5:87:83:3A:E3:B0:95:0D:77:28:A1:F9:8E:9B:B2:61:82:E8:88:E9:BA:6D:6D:5E:E9:69:2F:99:9C:4E:C5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: web04zoom.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web04zoom.im/Windows/invite.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 13 Jan 2026 05:19:00 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\nalt-svc: h3=\":444\"; ma=2592000, h3-29=\":444\"; ma=2592000, h3-Q050=\":444\"; ma=2592000, h3-Q046=\":444\"; ma=2592000, h3-Q043=\":444\"; ma=2592000, quic=\":444\"; ma=2592000; v=\"43,46\"\r\nx-turbo-charged-by: LiteSpeed\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1238,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"0bde7d4b3da67537eaf9188e6f8049cf","sha1":"64300fc482d01d38b40ab20e15960b6509665e5a","sha256":"5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807","sha512":"2d4d27ab5b3dd2a701a944e9b5372b40ee4f8b3267f133be7ad0d4b42528302aaa002b6132722e2ad1fe629fc3e8baf1011c8dad326062e9c0946d6f1b6eafb4","ssdeep":"","tlshash":"8d21423ec1c1150a80271154fb81e2942619825192470fa1379e7167f6cc0f756937c8","first_seen":"2023-03-07T01:03:24Z","last_seen":"2026-08-05T16:51:42.597212Z","times_seen":41453,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"toolbox.marketingtools.apple.com/api/badges/download-on-the-app-store/black/en-us?size=250x83","fqdn":"toolbox.marketingtools.apple.com","domain":"apple.com","tld":"com"},"ip":{"addr":"17.33.192.145","port":443,"asn":714,"as":"APPLE-ENGINEERING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web04zoom.im/Windows/invite.php","date":"2026-01-13T05:19:00.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"toolbox.marketingtools.apple.com","organization":"Apple Inc."},"issuer":{"commonName":"Apple Public Server RSA CA 1 - G1","organization":"Apple Inc."},"validity":{"start":"Sun, 11 Jan 2026 21:19:04 GMT","end":"Tue, 07 Apr 2026 19:58:35 GMT"},"fingerprint":{"sha1":"54:E9:62:83:51:D3:66:93:F1:D1:2D:73:C0:7F:51:7B:6D:33:BC:CD","sha256":"F7:06:9D:52:52:6C:7C:4A:11:8B:E2:7A:2C:82:64:AA:FF:15:32:CF:9E:22:23:0B:CD:50:9D:9E:3E:30:1A:A2"}}},"request":{"raw":"GET /api/badges/download-on-the-app-store/black/en-us?size=250x83 HTTP/1.1\r\nHost: toolbox.marketingtools.apple.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web04zoom.im/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: Apple\r\ndate: Tue, 13 Jan 2026 05:19:01 GMT\r\ncontent-type: image/svg+xml\r\ncontent-security-policy: default-src 'self';  script-src 'self' 'unsafe-inline';  style-src 'self' 'unsafe-inline' https://www.apple.com;  connect-src 'self';  img-src 'self' blob: data: https://toolbox.marketingtools.apple.com https://tools.applemediaservices.com https://apple-resources.s3.amazonaws.com https://*.mzstatic.com;  font-src 'self' https://www.apple.com;  object-src 'none';  base-uri 'self';  form-action 'self';  frame-ancestors 'self';  upgrade-insecure-requests;  frame-src 'self' https://embed.podcasts.apple.com https://embed.music.apple.com https://embed.tv.apple.com;  media-src 'self' https://audio-ssl.itunes.apple.com;\r\nvary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url\r\ncache-control: public, max-age=604800\r\nstrict-transport-security: max-age=31536000; includeSubdomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cache: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":10804,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2928664fe1fc6aca88583a6f606d60ba","sha1":"2f2fe1cbd0563b3ce3ea79fcdf1549ed244b3993","sha256":"a26fc5b38380272c92e9019a2eb8b45542a66814b3e2b203772db8904b9fb99f","sha512":"7d6f8b7e54a4da3cf81c767b4aa40c3b04bafe35f2dd77b85944de4442f0b1dd1a8eda0175deb4652cf055094acdc0d4b6e38abe51c52a3dfbf887481315b347","ssdeep":"192:v6+WE7QxvAjShzwzb7M1/myAYUNNdZnvGuQTF4U:v6+Pkxv44q/EH10U","tlshash":"7122a3b753748ad262d183c52d2e27a83b74a5feb22042c4778f155abf429b35439cd2","first_seen":"2023-05-03T18:10:19Z","last_seen":"2026-08-05T20:55:03.903457Z","times_seen":9497,"resource_available":false,"data":null}},"time_used":1424,"timings":{"blocked":540,"dns":4,"connect":175,"send":0,"wait":344,"receive":0,"ssl":358},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web04zoom.im/Windows/invite.php","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"ip":{"addr":"89.163.155.33","port":443,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-13T05:19:00.222Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web04zoom.im.web04zoom.us","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:41:37 GMT","end":"Sun, 12 Apr 2026 13:41:36 GMT"},"fingerprint":{"sha1":"53:9E:75:4B:7B:02:0A:57:CA:FB:93:0E:48:9A:85:BD:67:11:AE:8F","sha256":"4B:C5:87:83:3A:E3:B0:95:0D:77:28:A1:F9:8E:9B:B2:61:82:E8:88:E9:BA:6D:6D:5E:E9:69:2F:99:9C:4E:C5"}}},"request":{"raw":"GET /Windows/invite.php HTTP/1.1\r\nHost: web04zoom.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web04zoom.im/\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 13 Jan 2026 05:19:00 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nalt-svc: h3=\":444\"; ma=2592000, h3-29=\":444\"; ma=2592000, h3-Q050=\":444\"; ma=2592000, h3-Q046=\":444\"; ma=2592000, h3-Q043=\":444\"; ma=2592000, quic=\":444\"; ma=2592000; v=\"43,46\"\r\nx-turbo-charged-by: LiteSpeed\r\nContent-Encoding: br\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5329,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"66cb1e59222c7b6d6575cc224049b9af","sha1":"e26fc2dcd51dc18e7e878274ebfb6beeaca9131e","sha256":"bd4ed2a8a5ac72f456358ca286ea8e9808a98440f088b67b902a3973b9cdb277","sha512":"615cc2d0e459ea90803b3f482f771899f4d4cda12ea7df953179f2022dbd559f76229f1172b711980b814bca238777a5ee4f73af17573fc3996a9be269765b0b","ssdeep":"48:tzJOtluUQszevTf3vrORIKJXlOzotWJz1TGqL/XQOpDSmCTEL0yR0FEEH8UyCKNG:qtevL3vj8VO1hG0/h+xA7Och6HuhK+4","tlshash":"aeb1240ad1c1110b4733e3999f76a758fb9340d7c641a5893aec129bcfb9908c253ede","first_seen":"2026-01-13T05:19:42.589691Z","last_seen":"2026-01-13T05:19:42.589691Z","times_seen":1,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tools.applemediaservices.com/api/badges/download-on-the-app-store/black/en-us?size=250x83","fqdn":"tools.applemediaservices.com","domain":"applemediaservices.com","tld":"com"},"ip":{"addr":"17.253.142.4","port":443,"asn":714,"as":"APPLE-ENGINEERING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web04zoom.im/Windows/invite.php","date":"2026-01-13T05:19:00.281Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"apple401k.com","organization":"Apple Inc."},"issuer":{"commonName":"Apple Public Server RSA CA 11 - G1","organization":"Apple Inc."},"validity":{"start":"Sat, 27 Dec 2025 03:51:18 GMT","end":"Fri, 27 Mar 2026 04:01:13 GMT"},"fingerprint":{"sha1":"1F:63:46:27:8A:92:A9:1C:74:32:DE:57:AC:8E:EF:DD:18:58:CF:D4","sha256":"71:5A:16:45:13:2D:EF:2A:B4:A7:E5:4A:D9:90:09:A6:AE:EF:C7:AE:94:BD:53:FE:BE:07:2E:E8:1D:D0:9A:FD"}}},"request":{"raw":"GET /api/badges/download-on-the-app-store/black/en-us?size=250x83 HTTP/1.1\r\nHost: tools.applemediaservices.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web04zoom.im/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nLocation: https://toolbox.marketingtools.apple.com/api/badges/download-on-the-app-store/black/en-us?size=250x83\r\nReferer: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/en-us\r\nServer: purple\r\nDate: Tue, 13 Jan 2026 05:19:00 GMT\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":10804,"size_decoded":0,"mime_type":"image/svg+xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-05T21:03:26.665966Z","times_seen":17731141,"resource_available":true,"data":null}},"time_used":1091,"timings":{"blocked":489,"dns":4,"connect":113,"send":0,"wait":111,"receive":0,"ssl":372},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"play.google.com/intl/en_us/badges/static/images/badges/en_badge_web_generic.png","fqdn":"play.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"172.217.19.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web04zoom.im/Windows/invite.php","date":"2026-01-13T05:19:00.282Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:08:50 GMT","end":"Tue, 03 Mar 2026 17:08:49 GMT"},"fingerprint":{"sha1":"4E:67:15:A5:9D:9D:98:A7:31:FB:B5:F3:17:B7:3F:E6:D6:F0:4B:7F","sha256":"87:15:95:F6:B4:66:1C:EA:67:E6:A1:66:94:F1:23:B9:C6:22:21:9A:7D:61:12:A8:39:01:5B:6D:D6:87:6C:30"}}},"request":{"raw":"GET /intl/en_us/badges/static/images/badges/en_badge_web_generic.png HTTP/1.1\r\nHost: play.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web04zoom.im/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: image/png\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/play_google\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"uxe-owners-acl/play_google\"\r\nreport-to: {\"group\":\"uxe-owners-acl/play_google\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/play_google\"}]}\r\ncontent-length: 4904\r\ndate: Tue, 13 Jan 2026 05:19:00 GMT\r\nexpires: Tue, 13 Jan 2026 05:19:00 GMT\r\ncache-control: private, max-age=0\r\nlast-modified: Thu, 04 Aug 2022 06:08:00 GMT\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4904,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 646 x 250, 8-bit colormap, non-interlaced","md5":"1e91d02cf5a902f38f2923c006d79281","sha1":"cb8126b32c2274e0394246b40bd0b7f9f847e44c","sha256":"f72611e2df8e88204009fd896d05d5e8e83c77009c63943bbffa169559934849","sha512":"54b69544dc55addc0b2ddc08418d1a0a34240697070fe47feae9e915c70d33ef662ce1b7154cbcad84019d22f3291f138cc7298224d381cc740c2097478d4042","ssdeep":"96:OdBnjzG7DZTxqIfy33nn/qf46vhPQuAgul5SZBsj51v1f:OdBnjwDZTx5fy33no4ShRjuX2sd1vt","tlshash":"b0a18e8f3e019ae0faca1277c6d3c835e4206c672c3767045a82f2ef51a25e7493e566","first_seen":"2023-05-03T20:05:42Z","last_seen":"2026-08-05T12:04:58.471264Z","times_seen":1829,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":64,"dns":1,"connect":8,"send":0,"wait":19,"receive":1,"ssl":54},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cold-na-phx-4.gofile.io/download/direct/a746b09b-035e-4cfb-a76a-8efd67b73c35/ZoomWorkspace.vbs","fqdn":"cold-na-phx-4.gofile.io","domain":"gofile.io","tld":"io"},"ip":{"addr":"94.139.32.21","port":443,"asn":0,"as":"","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-13T05:19:04.875Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gofile.io","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Oct 2025 17:06:39 GMT","end":"Sun, 25 Jan 2026 17:06:38 GMT"},"fingerprint":{"sha1":"2A:50:AA:A4:6A:47:6B:F2:53:35:6D:99:BC:2D:70:EB:99:B2:3E:6A","sha256":"D9:D1:DE:54:6F:35:3D:E1:91:F0:E7:24:34:67:92:6F:03:C7:74:11:6E:9D:39:0C:5C:03:E5:D4:64:2C:63:92"}}},"request":{"raw":"GET /download/direct/a746b09b-035e-4cfb-a76a-8efd67b73c35/ZoomWorkspace.vbs HTTP/1.1\r\nHost: cold-na-phx-4.gofile.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Tue, 13 Jan 2026 05:19:05 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 125\r\nConnection: keep-alive\r\nAccess-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization\r\nAccess-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range\r\nLocation: https://cold-na-phx-9.gofile.io/download/direct/a746b09b-035e-4cfb-a76a-8efd67b73c35/ZoomWorkspace.vbs\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Robots-Tag: noindex, nofollow\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2152,"size_decoded":0,"mime_type":"text/vbscript; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-05T21:03:26.665966Z","times_seen":17731141,"resource_available":true,"data":null}},"time_used":903,"timings":{"blocked":363,"dns":10,"connect":170,"send":0,"wait":177,"receive":1,"ssl":179},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"cold-na-phx-4.gofile.io","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cold-na-phx-9.gofile.io/download/direct/a746b09b-035e-4cfb-a76a-8efd67b73c35/ZoomWorkspace.vbs","fqdn":"cold-na-phx-9.gofile.io","domain":"gofile.io","tld":"io"},"ip":{"addr":"94.139.32.31","port":443,"asn":0,"as":"","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-13T05:19:05.421Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gofile.io","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Mon, 27 Oct 2025 17:06:39 GMT","end":"Sun, 25 Jan 2026 17:06:38 GMT"},"fingerprint":{"sha1":"2A:50:AA:A4:6A:47:6B:F2:53:35:6D:99:BC:2D:70:EB:99:B2:3E:6A","sha256":"D9:D1:DE:54:6F:35:3D:E1:91:F0:E7:24:34:67:92:6F:03:C7:74:11:6E:9D:39:0C:5C:03:E5:D4:64:2C:63:92"}}},"request":{"raw":"GET /download/direct/a746b09b-035e-4cfb-a76a-8efd67b73c35/ZoomWorkspace.vbs HTTP/1.1\r\nHost: cold-na-phx-9.gofile.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 13 Jan 2026 05:19:05 GMT\r\nContent-Type: text/vbscript; charset=utf-8\r\nContent-Length: 2152\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization\r\nAccess-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range\r\nContent-Disposition: attachment; filename*=UTF-8''ZoomWorkspace.vbs\r\nLast-Modified: Mon, 22 Dec 2025 20:55:23 GMT\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nX-Robots-Tag: noindex, nofollow\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2152,"size_decoded":0,"mime_type":"text/vbscript; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"d8b44645f742a4a5b7c67f5725408ad5","sha1":"fe3abf15688ae29d4d29db84993a582710d29bc6","sha256":"517188c677812873e0be3348a0508b858fd9f52ffe4dcb5a9cafc856f38c7f95","sha512":"739a1868cf20ebd0b2f55ff3b032a240bf966eb54b3e70a15e0c88c07c00a04ffe42aa1378255408a0cf37329387b4915d45e43d2fe6c67a37e5b4bb1240f11d","ssdeep":"","tlshash":"8541341fbd0ab270a83257b68a67dc1dc4d0986324265c94b58cc4c29f3037dfe945f6","first_seen":"2026-01-13T05:19:42.591568Z","last_seen":"2026-01-13T05:19:42.591568Z","times_seen":1,"resource_available":false,"data":null}},"time_used":899,"timings":{"blocked":359,"dns":11,"connect":169,"send":0,"wait":180,"receive":1,"ssl":177},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-13","alert":"Sinkholed","trigger":"cold-na-phx-9.gofile.io","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web04zoom.im/","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"ip":{"addr":"89.163.155.33","port":443,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-13T05:18:59.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web04zoom.im.web04zoom.us","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:41:37 GMT","end":"Sun, 12 Apr 2026 13:41:36 GMT"},"fingerprint":{"sha1":"53:9E:75:4B:7B:02:0A:57:CA:FB:93:0E:48:9A:85:BD:67:11:AE:8F","sha256":"4B:C5:87:83:3A:E3:B0:95:0D:77:28:A1:F9:8E:9B:B2:61:82:E8:88:E9:BA:6D:6D:5E:E9:69:2F:99:9C:4E:C5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: web04zoom.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 13 Jan 2026 05:18:59 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 44\r\nConnection: keep-alive\r\nalt-svc: h3=\":444\"; ma=2592000, h3-29=\":444\"; ma=2592000, h3-Q050=\":444\"; ma=2592000, h3-Q046=\":444\"; ma=2592000, h3-Q043=\":444\"; ma=2592000, quic=\":444\"; ma=2592000; v=\"43,46\"\r\nx-turbo-charged-by: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":44,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with no line terminators","md5":"0712ce89abf3d56c0ead17b3cf7eb847","sha1":"b66f8851549322ce3979fe0b632978efca33a14d","sha256":"7fd3d2956d216c23e560f747d2ea30fb469986fac634ddc483e38bcca49bdd95","sha512":"49bd0915437f76b602085607753755c95e9c5e697d75d42fa61941bede850c606d9ac4f9369cf1bc12e6551944a1b0dc6e009bb8b9194bd72b0de72c052c924c","ssdeep":"","tlshash":"f59002490e10930031b110024526a20d141244d66444d09100d54010b42038b491a996","first_seen":"2025-04-23T18:54:22.487114Z","last_seen":"2026-07-30T20:00:34.877968Z","times_seen":129,"resource_available":true,"data":null}},"time_used":340,"timings":{"blocked":156,"dns":100,"connect":22,"send":0,"wait":23,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web04zoom.im/Windows/","fqdn":"web04zoom.im","domain":"web04zoom.im","tld":"im"},"ip":{"addr":"89.163.155.33","port":443,"asn":24961,"as":"WIIT AG","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-13T05:18:59.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web04zoom.im.web04zoom.us","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:41:37 GMT","end":"Sun, 12 Apr 2026 13:41:36 GMT"},"fingerprint":{"sha1":"53:9E:75:4B:7B:02:0A:57:CA:FB:93:0E:48:9A:85:BD:67:11:AE:8F","sha256":"4B:C5:87:83:3A:E3:B0:95:0D:77:28:A1:F9:8E:9B:B2:61:82:E8:88:E9:BA:6D:6D:5E:E9:69:2F:99:9C:4E:C5"}}},"request":{"raw":"GET /Windows/ HTTP/1.1\r\nHost: web04zoom.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web04zoom.im/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx\r\nDate: Tue, 13 Jan 2026 05:18:59 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nlocation: visit.php\r\ncache-control: no-cache, no-store, must-revalidate, max-age=0\r\nalt-svc: h3=\":444\"; ma=2592000, h3-29=\":444\"; ma=2592000, h3-Q050=\":444\"; ma=2592000, h3-Q046=\":444\"; ma=2592000, h3-Q043=\":444\"; ma=2592000, quic=\":444\"; ma=2592000; v=\"43,46\"\r\nx-turbo-charged-by: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":5329,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-05T21:03:26.665966Z","times_seen":17731141,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}