{"report_id":"3c52f8fd-c2aa-4e95-b047-c10b044c3a5c","version":6,"status":"done","tags":[],"date":"2026-01-26T04:55:35Z","url":{"schema":"http","addr":"autoconfig.out-coinbase.com","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"title":"mail.out-coinbase.com - mail UI","dom":{"size":39368,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (8342)","md5":"fbe9eddc67c6836ae2eab74923a987ff","sha1":"ac8eb714fc01d6b374619d9d46b48dcb307e9b43","sha256":"9ebf74fd2e78d9af4c3d7286507906cbde264b5f6a242f14fd01b02f0950fa14","sha512":"3b64ffe2b0d8cf0ca9618527ab02a1ca8fabdd535cac7b7bbd27d12de3dc45474aac26b96fca3d72bfd1c926d06fcea0bb79443d5ca8249d6ded38342748e3dd","ssdeep":"768:RujsZSzgABnCgNRhvvr3DjJNfw3bG9+3bALhzwYczgk6oPJ7QJb:RGsZLKbh7zjJNfd+3bWzKzgk6oPJ7QJb","tlshash":"ce03e85689f204330bf321df7a5667033ae58093d654890079ed439c5fecee6ba27a8d","dom_hash":"domhashd9f2dfe3aafab6d03fed3df0b611f5df","first_seen":"2026-01-26T04:55:38.196854Z","last_seen":"2026-01-26T04:55:38.196854Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"autoconfig.out-coinbase.com","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-02T04:55:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"autoconfig.out-coinbase.com","ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2026-01-24","domain_rank":0,"first_seen":"2026-01-26T01:37:18.86414Z","last_seen":"2026-01-26T01:37:18.864141Z","alert_count":16,"request_count":16,"received_data":2563980,"sent_data":8909,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"cb7a44585af9bf55eca6bafeff8cf683","sha1":"7b7eb940c87bee93eb91f50a2544c3f499e7880f","sha256":"36df420a1509ed034001f03ea8089a3a832ec96784ce27d1e6942704c3c612fc","sha512":"ca786ec0b8a582df454dce75829122126a4243d034fa4fc34f8219ee8aad35ed7358439b8c048475de034bc0ee0958fd79e8ed1ceeac8e72702a102e0b669751","ssdeep":"","tlshash":"24f0c9714c6b02429eaa05faab2ea411f2652033023ce000f84c8c6c7f94f5e6133bca","size":556,"data":"","first_seen":"2023-03-13T14:24:52Z","last_seen":"2026-06-06T19:45:56.644696Z","times_seen":481,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/cache/97de29030b01af5b720989e26703fcf354efbcf2.js","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0959f95c324836ac756b59c0c4f046f5","sha1":"a3967ce95bbd9d824252c5ddeb66e8b74189d814","sha256":"9934ba844870f60bd9562062509c8462361b71e480bdba35641026ac7f154751","sha512":"48fed23a5498f253891bd2aea9be8e5d67b1cc02aba63cf3a57fa01b5437b903a0a2cba694fb1c6fc1c1c2ae6fd33885bb066a3ad3c3bfe494faf8da4feb17c5","ssdeep":"24576:FB360bBy4QKcg1YjVXc2NhnyKMeIaQIFcpCL1JLJ32AaV5vWi:FB36UByZKcmYjVXcKhnyKMeIaQIFcpCs","tlshash":"6d154a497341703a42eb20f6586f0a0ab23695556409c4b8f5bcc9d92dbac4372bff7e","size":924216,"data":"","first_seen":"2025-10-08T11:13:18.610962Z","last_seen":"2026-07-21T17:10:56.717081Z","times_seen":131,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1c4552acf2b493a9d3ca5f9c4d2844b6","sha1":"918b8279c3a227ab17ffa9e8cad668ab5f921dbb","sha256":"05da2c3b3afba57db595a7b718707df9bf809568423c35de00c0f1e54b8b3b7c","sha512":"0aa758a223122b07852c90b4188171df736fb3b857ac4669daf6e7ed824975fe740a755e72ce85cd3665650a659d53d1fd4466cf735887265242299fc26b9765","ssdeep":"768:3BnCgNRhvvr3DjJNfw3bG9+3bALhzwYczgk6oPJ7QJ0:xbh7zjJNfd+3bWzKzgk6oPJ7QJ0","tlshash":"93c2e74e8ae204734ff321dfb597650235e580a2926489043cde96886fdcef9f6276cd","size":26360,"data":"","first_seen":"2026-01-26T04:55:38.215965Z","last_seen":"2026-01-26T04:55:38.215965Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/cache/3c8c8b3a1c6b3ce2aa532d167f918f5d056abec5.css","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /cache/3c8c8b3a1c6b3ce2aa532d167f918f5d056abec5.css HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Tue, 26 Jan 2027 04:55:13 GMT\r\npragma: cache\r\ncache-control: max-age=31536000\r\nstrict-transport-security: max-age=15768000;\r\nx-content-type-options: nosniff\r\nx-robots-tag: none\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":346102,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (65170)","md5":"b91cbb98a38ece9d9f20878d4e3204d6","sha1":"57d9365a8e832d17023cc438eb79d171dd6223fb","sha256":"c55b0c7fd6bd21a897ae43c0c55cbaf1c3756ad28953177369517129e8e8bf01","sha512":"fee5cc5e5040fbbf896e4323707b32f25a820c68550d5eca9ca6e0fe6ea67db9dcb4e648ae5d0f06335ddb4ef7091e07baedbf015a065fb8fba43a102c8620e1","ssdeep":"6144:3t+5ZLm8c4uTLj1cU7oovLYz3i6PSbh68r:NLj1cUsovLYz3i6PSbhtr","tlshash":"097462a2f58520ddf363c02bbb817b6c61aff559d6410e7af01b626c4ac128516b3f78","first_seen":"2025-04-23T22:59:47.742922Z","last_seen":"2026-08-04T04:39:21.392519Z","times_seen":429,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-700.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.561Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-700.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 155152\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-25e10\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155152,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 155152, version 1.0","md5":"c66bedf0712ec4954b9a63d8924c4b9e","sha1":"6340eceeeb07f4234e0618df488e16062c68f65d","sha256":"6a2f4003a98a3d8b367702823291c5e43078623288deff831d9d83c8f2db9b16","sha512":"4187579e570f36fba5efe3e8260be7f47669468ee77e478df3e206b303c7fbef81eeb21750e694dd5d151ccc2ec09733d3907b90ceab8d1529208e5561b6ef4d","ssdeep":"3072:Rnuyyh362si6MpXlK/53z+6E55c0w7uPtAbFh1obbLV6FG+gMPmVp97Ttiqgh0aM:Zk768cBD+J5bwC6h1I2gM29oz0aM","tlshash":"74e31229432a5a7f4150e27e96542b51a3fb3747212a310f0a8c64bfd744bcc6bc7ead","first_seen":"2023-05-15T21:21:54Z","last_seen":"2026-08-08T13:53:46.468128Z","times_seen":977,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-italic.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-italic.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 119256\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-1d1d8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119256,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 119256, version 1.0","md5":"b3bf407526d73f71794361c5fb48290f","sha1":"9473aff269af1a8912f6e4cfeeb3b20a84b83b21","sha256":"a954c0a79c10d3b1bc92da8061a74c4bf99ade39a5f0b385de63e14e569a23db","sha512":"0e0c2f9a90c5b580654738f855fcc0eba15416c1a3354195573ec418a2378bb6d9b4be0ae68f1dc9c1bffa9cb634dc064ba06598a0a577fe67d10e597f1a771c","ssdeep":"3072:1Xx2eAGMpObjvthHSpqaivDKJi8YDMrkKTXIpnSVKh:B79Ms1hs5iWEWgKYpSVs","tlshash":"4cc3123ed6b67bc4ba31cff935a88d6280539681a1377383e85108ac76116df95c2e4f","first_seen":"2023-05-21T01:22:48Z","last_seen":"2026-08-08T13:53:46.475017Z","times_seen":790,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-700.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:14.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-700.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:14 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 155152\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-25e10\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155152,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 155152, version 1.0","md5":"c66bedf0712ec4954b9a63d8924c4b9e","sha1":"6340eceeeb07f4234e0618df488e16062c68f65d","sha256":"6a2f4003a98a3d8b367702823291c5e43078623288deff831d9d83c8f2db9b16","sha512":"4187579e570f36fba5efe3e8260be7f47669468ee77e478df3e206b303c7fbef81eeb21750e694dd5d151ccc2ec09733d3907b90ceab8d1529208e5561b6ef4d","ssdeep":"3072:Rnuyyh362si6MpXlK/53z+6E55c0w7uPtAbFh1obbLV6FG+gMPmVp97Ttiqgh0aM:Zk768cBD+J5bwC6h1I2gM29oz0aM","tlshash":"74e31229432a5a7f4150e27e96542b51a3fb3747212a310f0a8c64bfd744bcc6bc7ead","first_seen":"2023-05-15T21:21:54Z","last_seen":"2026-08-08T13:53:46.468128Z","times_seen":977,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/api/v1/get/passwordpolicy/html","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.818Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /api/v1/get/passwordpolicy/html HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://autoconfig.out-coinbase.com/\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\naccess-control-allow-origin: mail.out-coinbase.com\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTION, OPTIONS\r\naccess-control-allow-headers: Accept, Content-Type, X-Api-Key, Origin\r\nstrict-transport-security: max-age=15768000;\r\nx-content-type-options: nosniff\r\nx-robots-tag: none\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T01:49:07.654675Z","times_seen":17790798,"resource_available":true,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-regular.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:14.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-regular.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:14 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 156884\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-264d4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":156884,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 156884, version 1.0","md5":"562c99547de538ff0ba6e31082d63f54","sha1":"854b89b02edcc2358b34c0bd92847cadab9afaac","sha256":"16bb3d8fb5c371c9e4fa6b5f313c0a5e2edd911c0ce6d0f9c3cee01e9560a2b3","sha512":"efaba6c39d659349c349f1d16046f64830756495471434d5a041fab9052db033091bad8f9afeee75e9665a31966778eda6ef9dcca0c00dd56614b11042d1f874","ssdeep":"3072:LuxuBf1oEcdfIp93FuFQd7Zg2c4j+99jPfe7egFsQCEjvOQjpw:ykBdZGfIv3FuFQpZncV99XeyiHiQja","tlshash":"5de312e025cb809ff52347a9e9a0dc2acb7a488d52d85b90a18bcd7fd17de6121ec061","first_seen":"2023-05-15T21:21:54Z","last_seen":"2026-08-08T13:53:46.511938Z","times_seen":1019,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/cache/97de29030b01af5b720989e26703fcf354efbcf2.js","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.418Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /cache/97de29030b01af5b720989e26703fcf354efbcf2.js HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Tue, 26 Jan 2027 04:55:13 GMT\r\npragma: cache\r\ncache-control: max-age=31536000\r\nstrict-transport-security: max-age=15768000;\r\nx-content-type-options: nosniff\r\nx-robots-tag: none\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":924216,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"0959f95c324836ac756b59c0c4f046f5","sha1":"a3967ce95bbd9d824252c5ddeb66e8b74189d814","sha256":"9934ba844870f60bd9562062509c8462361b71e480bdba35641026ac7f154751","sha512":"48fed23a5498f253891bd2aea9be8e5d67b1cc02aba63cf3a57fa01b5437b903a0a2cba694fb1c6fc1c1c2ae6fd33885bb066a3ad3c3bfe494faf8da4feb17c5","ssdeep":"24576:FB360bBy4QKcg1YjVXc2NhnyKMeIaQIFcpCL1JLJ32AaV5vWi:FB36UByZKcmYjVXcKhnyKMeIaQIFcpCs","tlshash":"6d154a497341703a42eb20f6586f0a0ab23695556409c4b8f5bcc9d92dbac4372bff7e","first_seen":"2025-10-08T11:13:18.610962Z","last_seen":"2026-07-21T17:10:56.717081Z","times_seen":131,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/img/cow_mailcow.svg","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /img/cow_mailcow.svg HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69755531-38d8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14552,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"789d7247bcf7cb1dd8c41b70858393a2","sha1":"d7c19a6abd1ae64f9a9fa3a28fdab75e6faf6c3d","sha256":"86a8eab3a89e2fa7c65a068a93ed9b94536d58d77d8a931665d101f94bd70786","sha512":"9a25f748ff63c79894f8d64072fdadf790cc29ee70653b38d5d7af566f89501b11f77eda06b228b53bd24de95865139299628e1c71a5b5a3d7b3b4103c55b9f0","ssdeep":"384:u46B5usHSdJRgTR305vgkzqIVKdpZzE1Rv:u46B5usHSdJRkF05lqPU","tlshash":"76627199eb7404f0e24f2bb189f01e48632124f347354d14ba6d6da49fa6bc2b358fd9","first_seen":"2023-05-21T01:22:48Z","last_seen":"2026-08-04T04:39:21.393591Z","times_seen":367,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/bootstrap-icons.woff2?524846017b983fc8ded9325d94ed40f3","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/bootstrap-icons.woff2?524846017b983fc8ded9325d94ed40f3 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 102536\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-19088\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102536,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 102536, version 1.0","md5":"1ed478a6b265d4b4f5c26bb063203588","sha1":"1ca5e8c7d2fb8e9d60ad1a1feb2a46e98c248a3d","sha256":"c874e14c63db86c4c5318c77cb557fce7036645edc7d690dcc1d23b389631b13","sha512":"6aa92a97373e55521584bf67eae83160e01f38f636e09aa90ddfb085b020d02662393998e620e416a2bb6a198b90f1f0bd1ab66fa350e310f0f6511bd01b0ec9","ssdeep":"1536:JdO26Vlt/8WEjNkZWNvZy4m4I2Do5H7Z3BvgoXK/tNh8XEorh/gQOns6trAk2Xt:J42o3WY4I2Do5NxvgxtNGXEofDW4","tlshash":"3fa31232a784011e2128daf7a453f2f805d9e786efb327d963c0817597e78d267a43d2","first_seen":"2023-04-07T09:04:20Z","last_seen":"2026-08-07T23:47:52.670306Z","times_seen":5166,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-700italic.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:14.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-700italic.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:14 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 125244\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-1e93c\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":125244,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 125244, version 1.0","md5":"dc1e0f60d0747904166eb7e3a6b516f3","sha1":"3013731bd1a4e86083809168666082013810ecbb","sha256":"0bc6089e574f4e86713e5c4911a09ed7766cdf6b6a23991a7d024ea3df16754d","sha512":"12d3c5cec151dcfb6a7463df0c94dd50fe9695f10c3a02f941750f7e3c2dfbd6096797b3d29e11f0f0fa5be6da5f4392158271ca4f2069c941c11ad2010b99c8","ssdeep":"3072:hKYtXKGmEYbbM3VqcOg0vrRwhNc1tKV8+H0J+:hx1zmEYb2V3h0vF8c1e8U0J+","tlshash":"c5c3121452a5485f0f096bce03a681c3dddf7e396f2656e2e06a7977176084a1efb204","first_seen":"2023-05-21T01:22:48Z","last_seen":"2026-08-04T14:42:01.339385Z","times_seen":592,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-700italic.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.661Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-700italic.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 125244\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-1e93c\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":125244,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 125244, version 1.0","md5":"dc1e0f60d0747904166eb7e3a6b516f3","sha1":"3013731bd1a4e86083809168666082013810ecbb","sha256":"0bc6089e574f4e86713e5c4911a09ed7766cdf6b6a23991a7d024ea3df16754d","sha512":"12d3c5cec151dcfb6a7463df0c94dd50fe9695f10c3a02f941750f7e3c2dfbd6096797b3d29e11f0f0fa5be6da5f4392158271ca4f2069c941c11ad2010b99c8","ssdeep":"3072:hKYtXKGmEYbbM3VqcOg0vrRwhNc1tKV8+H0J+:hx1zmEYb2V3h0vF8c1e8U0J+","tlshash":"c5c3121452a5485f0f096bce03a681c3dddf7e396f2656e2e06a7977176084a1efb204","first_seen":"2023-05-21T01:22:48Z","last_seen":"2026-08-04T14:42:01.339385Z","times_seen":592,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-26T04:55:13.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6; path=/; secure; HttpOnly; SameSite=Lax\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=15768000;\r\nx-content-type-options: nosniff\r\nx-robots-tag: none\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39135,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (8342)","md5":"660affd85bdd4dbb3a9b7dacaf8049d3","sha1":"13f5ae23c299a1232bc425bc648dfaf512025dfb","sha256":"d6e2ebd90a8cc25676d88a951224d2d40a244d6ea808391bb44688f7bc0bae0a","sha512":"f8cc082920900556d4c13d924b8025023cb7dcdc88eea40cf3abd7675e9e576c19d7eeaef17ec2821bd97aee53aeaba21dd223bb31285270e2ff23745f4ab774","ssdeep":"768:IBdsZSbgABnCgNRhvvr3DjJNfw3bG9+3bALhzwYczgk6oPJ7QJf:IjsZpKbh7zjJNfd+3bWzKzgk6oPJ7QJf","tlshash":"aa03d95689f204330bf321df7a5667033ae58093d654890079ed439c5fecee6ba27a8d","first_seen":"2026-01-26T04:55:38.211149Z","last_seen":"2026-01-26T04:55:38.211149Z","times_seen":1,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":142,"dns":86,"connect":25,"send":0,"wait":47,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/css/flags/4x3/en.svg","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /css/flags/4x3/en.svg HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69755531-21a\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":538,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d3ddd6025a06a78535b0d432d14905bf","sha1":"2b5148a18b90f933e47bf895c26d61a52d21d9d8","sha256":"825310f9bcc8892559317bfc87fc28d5d7bad06c02d562b5740aafcf4b040803","sha512":"618481c44206c46bf35212f5b2206457c641417ce2bd575867eb6cf43776a7e363ae7aef7ce339d304c4d73a1054b1d5f6c5ebf6f8d8dbf2bdf41d442e2e33ad","ssdeep":"","tlshash":"d2f0c9d8c72c3044c70a97105cacb8e3d4d9a1cd999004eab8e09ae460a9b97dccadd1","first_seen":"2023-04-07T07:31:08Z","last_seen":"2026-08-08T06:12:05.945457Z","times_seen":5167,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-regular.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-regular.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 156884\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-264d4\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":156884,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 156884, version 1.0","md5":"562c99547de538ff0ba6e31082d63f54","sha1":"854b89b02edcc2358b34c0bd92847cadab9afaac","sha256":"16bb3d8fb5c371c9e4fa6b5f313c0a5e2edd911c0ce6d0f9c3cee01e9560a2b3","sha512":"efaba6c39d659349c349f1d16046f64830756495471434d5a041fab9052db033091bad8f9afeee75e9665a31966778eda6ef9dcca0c00dd56614b11042d1f874","ssdeep":"3072:LuxuBf1oEcdfIp93FuFQd7Zg2c4j+99jPfe7egFsQCEjvOQjpw:ykBdZGfIv3FuFQpZncV99XeyiHiQja","tlshash":"5de312e025cb809ff52347a9e9a0dc2acb7a488d52d85b90a18bcd7fd17de6121ec061","first_seen":"2023-05-15T21:21:54Z","last_seen":"2026-08-08T13:53:46.511938Z","times_seen":1019,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/favicon.png","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:13.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:13 GMT\r\ncontent-type: image/png\r\ncontent-length: 17611\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-44cb\"\r\nstrict-transport-security: max-age=15768000;\r\nx-content-type-options: nosniff\r\nx-robots-tag: none\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17611,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"e78b44f90f9bb1da18152c9c0f9973ca","sha1":"8425331eb0802c1badac5256321b326d21dc4405","sha256":"0ad400d228ad2786ccfd32a54997e5b79ceb45beb7a629dd8eb692b47b70738e","sha512":"30ee8c47d33ef700a1d1510654dfa2036e12bdcb29a37c31c5cb443abd426fb1c6f63f3b80e06c233fee0b60ff46c7cfff48343ae5cf7dcb80ebfbfbfef0203f","ssdeep":"384:oqTiSU1F3ar5UqyOXMc7ruetUkemiCxwLk/Mj:oqTi/g+eMcf/lX7Mj","tlshash":"fa82c00d8f4206dbd22e7d7356cc04bf67bd6bf0c05db65aba082641158aecf865d306","first_seen":"2025-09-21T02:37:39.786418Z","last_seen":"2026-08-04T04:39:21.390833Z","times_seen":233,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"autoconfig.out-coinbase.com/fonts/noto-sans-v12-latin_greek_cyrillic-italic.woff2","fqdn":"autoconfig.out-coinbase.com","domain":"out-coinbase.com","tld":"com"},"ip":{"addr":"76.13.13.137","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://autoconfig.out-coinbase.com/","date":"2026-01-26T04:55:14.061Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mail.out-coinbase.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 25 Jan 2026 22:35:36 GMT","end":"Sat, 25 Apr 2026 22:35:35 GMT"},"fingerprint":{"sha1":"31:32:12:D1:10:20:E5:AA:FE:BA:BD:1B:75:3B:4B:E7:C8:7B:C2:8D","sha256":"0E:69:48:DC:12:AD:84:FB:F8:40:1A:DD:EE:91:1E:A3:A6:9C:42:D9:D2:4E:52:CD:03:A5:6F:B6:4F:A3:0D:E1"}}},"request":{"raw":"GET /fonts/noto-sans-v12-latin_greek_cyrillic-italic.woff2 HTTP/1.1\r\nHost: autoconfig.out-coinbase.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://autoconfig.out-coinbase.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: MCSESSID=bf147932c23fc3cbdc10050b27e48cb6\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 26 Jan 2026 04:55:14 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 119256\r\nlast-modified: Sat, 24 Jan 2026 23:26:41 GMT\r\netag: \"69755531-1d1d8\"\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119256,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 119256, version 1.0","md5":"b3bf407526d73f71794361c5fb48290f","sha1":"9473aff269af1a8912f6e4cfeeb3b20a84b83b21","sha256":"a954c0a79c10d3b1bc92da8061a74c4bf99ade39a5f0b385de63e14e569a23db","sha512":"0e0c2f9a90c5b580654738f855fcc0eba15416c1a3354195573ec418a2378bb6d9b4be0ae68f1dc9c1bffa9cb634dc064ba06598a0a577fe67d10e597f1a771c","ssdeep":"3072:1Xx2eAGMpObjvthHSpqaivDKJi8YDMrkKTXIpnSVKh:B79Ms1hs5iWEWgKYpSVs","tlshash":"4cc3123ed6b67bc4ba31cff935a88d6280539681a1377383e85108ac76116df95c2e4f","first_seen":"2023-05-21T01:22:48Z","last_seen":"2026-08-08T13:53:46.475017Z","times_seen":790,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-26","alert":"Sinkholed","trigger":"autoconfig.out-coinbase.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}