{"report_id":"3e065f5b-64ed-4394-9302-d01a247f160b","version":6,"status":"done","tags":["microsoft","phishing"],"date":"2026-06-04T11:29:33Z","url":{"schema":"http","addr":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","domain":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","domain":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","tld":"r2.dev"},"title":"Sign in to your Office365 account","dom":{"size":19379,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (19114)","md5":"fb4b60deb8a9e8bba91884bd85cf31d6","sha1":"0a179b11c3b173ac234c009c550b6c9bd5372bcd","sha256":"db64b0150cf7452ca0263e1d1215c8af435ce1bbd972d4f83390edef96e47cdb","sha512":"39664f5e2ef7f96891dcd659074f9d9233277d38a1a31e448557d12381fcd6f39c91663475bb6cd1090b7d4cfebc4ed9b55b1156adc4ffd2f5c25bcbfd7fb20d","ssdeep":"384:D7i76pyFJ7eFJ7ecR7ec47Dd7747R7RqytPhgTwZe08B7W7L7m7J7L7GqMsc7eom:D2OWCDCcRCcQNEldtOi1KCXStXyaTL","tlshash":"0592f9f2b0111e6a539b9df9f033d204313ae64dc3039d60e97c8a9416ffe19f52699a","dom_hash":"domhash9ed2d8b99fcf27da555495cc696aa162","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","domain":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-09T11:29:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":2,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-06-04T11:29:11Z","timestamp":1780572551,"ip_dst":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":34032,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI","source":"{\"timestamp\":\"2026-06-04T11:29:11.066125+0000\",\"flow_id\":15409831468684,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.26\",\"src_port\":34032,\"dest_ip\":\"104.18.54.45\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2062569,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare R2 Public Bucket (r2 .dev) Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"source\":{\"ip\":\"104.18.54.45\",\"port\":443},\"target\":{\"ip\":\"172.18.0.26\",\"port\":34032},\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2025_05_27\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Major\"],\"updated_at\":[\"2025_05_27\"]}},\"tls\":{\"sni\":\"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":945,\"bytes_toclient\":2671,\"start\":\"2026-06-04T11:29:11.056972+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-04","alert":"Phishing Block","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"cdn-jm-tools.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-05-31T22:37:14.287473Z","alert_count":0,"request_count":1,"received_data":90457,"sent_data":531,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"aadcdn.msauth.net","ip":{"addr":"13.107.246.53","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"domain_registered":"2018-10-25","domain_rank":5248,"first_seen":"2018-11-19T10:50:03Z","last_seen":"2026-06-03T14:18:03.779347Z","alert_count":0,"request_count":1,"received_data":2641,"sent_data":531,"comment":"","tags":null,"fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}]},{"fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-08-23","domain_rank":0,"first_seen":"2023-11-23T15:25:09Z","last_seen":"2026-06-04T03:23:16.794746Z","alert_count":10,"request_count":2,"received_data":47050,"sent_data":1129,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:3.5.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}]},{"fqdn":"cdn-jm-tools.web.app","ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2019-01-08","domain_rank":0,"first_seen":"2021-05-28T20:34:17Z","last_seen":"2026-05-28T22:23:19.63565Z","alert_count":4,"request_count":4,"received_data":109282,"sent_data":2113,"comment":"","tags":null,"fingerprints":[{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","domain":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"77b45dcf45cc5ba9dd0aa847e990527a","sha1":"5d0445901102f59ed00b8feedc3acf1b4a289967","sha256":"29913f54e87542276d441f5ce47348adc4e8526494753a817866c336929d859d","sha512":"bfd98b3416fe7d5e0667cf6197cb752319364d60da666651f99526d02d05c270b133f43e6f5c26ba9b472ccb03ab3de5a080340b3d9ff97b044ceb49525d2dcb","ssdeep":"","tlshash":"d1d01273aa4e91661d6480497565c048e27e414f1c9cc58df80c49177f018af64ea2cd","size":214,"data":"","first_seen":"2023-11-22T13:20:56Z","last_seen":"2026-06-04T11:29:34.489043Z","times_seen":591,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","domain":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"9602c36dc15068784670b20fb9b81291","sha1":"78c1e7455e9d3c28810b6416c8bf9bac29f4da2e","sha256":"bf2a3c0b7ae880d191361373d7be8a2b315aa23d833fd525810a26faccde68ec","sha512":"5a882756c215122e6b744d29e43583367534281ec5e8ab4f66b4c838a67c82b7e17680515f472ac060837908295f223a4a73d2f6e87537ce80b38211f3ce13a8","ssdeep":"","tlshash":"606122ca72460fba67fb395434271104f531e4a5ca05580156389ba92b3bfcaf12b74b","size":3179,"data":"","first_seen":"2023-03-08T14:31:42Z","last_seen":"2026-06-04T11:29:34.489649Z","times_seen":2291,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"12108007906290015100837a6a61e9f4","sha1":"1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3","sha256":"c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4","sha512":"93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530","ssdeep":"1536:YjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h5cApwEjOPrBeU6QLiTFbc0QlQvakF:YYh8eip3hXuf6IidlrvakdtQ47GK1","tlshash":"c393f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89493,"data":"","first_seen":"2023-03-07T01:03:07Z","last_seen":"2026-07-25T07:39:47.65312Z","times_seen":21434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","date":"2026-06-04T11:29:11.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 May 2026 03:46:57 GMT","end":"Mon, 10 Aug 2026 04:46:42 GMT"},"fingerprint":{"sha1":"95:12:1E:0A:F6:69:8B:FC:A0:08:DA:67:1A:A4:D1:9D:87:F5:E9:07","sha256":"F3:4A:39:63:C7:6A:CE:66:1A:B4:62:2C:E9:92:82:9A:81:78:1B:CC:3F:D5:2D:0A:6D:D6:89:D9:F6:66:7B:BC"}}},"request":{"raw":"GET /ajax/libs/jquery/3.5.0/jquery.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 04 Jun 2026 11:29:11 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:11:48 GMT\r\nvary: Accept-Encoding\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nx-cdnjs-cache: HIT\r\ncf-cache-status: HIT\r\nage: 72772\r\nexpires: Tue, 25 May 2027 11:29:11 GMT\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N8FrE1SjuGZzBn0drere1P%2Fqh2zX1YrTrlYP6PPszFb2k1B9Xeo444otspe2HSSzm9IJy0aasSg7hm6mxDztuQwqtmjEoQ9S1zMXBoV9oxpD0o7%2B6J7Qwf1FB8%2FiOgNPQgIY8wse\"}]}\r\ncf-ray: a066992ed81a35a6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":89493,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"12108007906290015100837a6a61e9f4","sha1":"1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3","sha256":"c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4","sha512":"93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530","ssdeep":"1536:YjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h5cApwEjOPrBeU6QLiTFbc0QlQvakF:YYh8eip3hXuf6IidlrvakdtQ47GK1","tlshash":"c393f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:03:07Z","last_seen":"2026-07-25T07:39:47.65312Z","times_seen":21434,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":14,"dns":1,"connect":1,"send":0,"wait":14,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"13.107.246.53","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","date":"2026-06-04T11:29:11.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aadcdn.msauth.net","organization":"Microsoft Corporation"},"issuer":{"commonName":"Microsoft TLS G2 RSA CA OCSP 04","organization":"Microsoft Corporation"},"validity":{"start":"Fri, 06 Mar 2026 19:39:46 GMT","end":"Wed, 02 Sep 2026 19:39:46 GMT"},"fingerprint":{"sha1":"90:D1:7D:09:02:B5:35:F1:FD:F7:6C:6A:EF:1D:B2:99:60:B0:E2:0C","sha256":"9C:1A:83:B2:23:49:7D:D8:8A:D4:AE:F6:D2:F6:A4:AB:35:F3:21:16:30:7F:01:51:68:8C:F6:B3:04:EA:91:B0"}}},"request":{"raw":"GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 04 Jun 2026 11:29:11 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 673\r\ncache-control: public, max-age=31536000\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 12 Feb 2020 22:01:30 GMT\r\netag: 0x8D7B0071D86E386\r\nx-ms-request-id: 03c16432-101e-0048-7fca-eede61000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\nx-azure-ref: 20260604T112911Z-15c9b49c7d4vhzv8hC1GVX8a1000000011n00000000009ha\r\nx-fd-int-roxy-purgeid: 0\r\nx-cache: TCP_HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}],"data":{"size":1864,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bc3d32a696895f78c19df6c717586a5d","sha1":"9191cb156a30a3ed79c44c0a16c95159e8ff689d","sha256":"0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68","sha512":"8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64","ssdeep":"","tlshash":"4e310059c51d3566ec04c3aceae1d468315e71efa8a581c961849b3f95b0dce0eccb70","first_seen":"2023-04-12T23:20:27Z","last_seen":"2026-07-25T12:19:54.618243Z","times_seen":103701,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":53,"dns":20,"connect":11,"send":0,"wait":11,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/*https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg*/","fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","domain":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","date":"2026-06-04T11:29:11.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 May 2026 06:57:47 GMT","end":"Mon, 10 Aug 2026 06:57:46 GMT"},"fingerprint":{"sha1":"24:D7:68:AF:FC:F2:DB:F6:04:47:7E:D0:7B:FF:F9:8E:74:18:97:12","sha256":"A7:D7:3C:F5:72:53:85:7E:A0:36:9A:EF:51:D0:3B:8B:FE:C9:91:D6:6C:42:05:07:D7:6C:7C:2E:4D:21:71:89"}}},"request":{"raw":"GET /*https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg*/ HTTP/1.1\r\nHost: pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Thu, 04 Jun 2026 11:29:11 GMT\r\nContent-Type: text/html\r\nContent-Length: 27150\r\nConnection: keep-alive\r\nServer: cloudflare\r\nCF-RAY: a06699300e5c120a-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27150,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (611)","md5":"46dd133ee00dc1bae5e4eeba7b88432f","sha1":"8af86a4ac91ce48c062216fb94a6e1d57618a19b","sha256":"9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66","sha512":"cb49f9e3812e2c262af374e79bd8905cb508a45bf2c2d6af62eed85af43770872486a55e9425882feda9fb3a57a317a3c18be1e286adaf0c76be7f1b0dfa8474","ssdeep":"384:6bamwIluB0sJQqCeSQup5szCUXAG0VVi82OgoKACZQQofNJXY3gW3:603Mp5If8WOmgW3","tlshash":"e3c291dc7be968e4e5de43aaef2831a8320ba0fb17425904f51d12142f0655cec6f6ed","first_seen":"2024-07-03T19:18:11Z","last_seen":"2026-07-24T21:54:43.295241Z","times_seen":32686,"resource_available":true,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-04","alert":"Phishing Block","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn-jm-tools.web.app/d..p/others/mi..cro---t/Converged_v21033_U7M7Fc-d_yiO2hIJng7nRg2.css","fqdn":"cdn-jm-tools.web.app","domain":"cdn-jm-tools.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","date":"2026-06-04T11:29:11.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.app","organization":""},"issuer":{"commonName":"WR4","organization":"Google Trust Services"},"validity":{"start":"Wed, 20 May 2026 17:14:17 GMT","end":"Tue, 18 Aug 2026 17:14:16 GMT"},"fingerprint":{"sha1":"45:CE:8E:05:99:1F:29:93:E3:1B:E1:2A:53:01:51:9E:33:30:9D:9B","sha256":"06:CB:0A:7C:41:2F:53:9C:E6:24:BF:F0:F5:45:4F:8A:4A:38:C5:4B:5E:F8:D6:F8:A7:FC:76:1B:1B:14:1A:CE"}}},"request":{"raw":"GET /d..p/others/mi..cro---t/Converged_v21033_U7M7Fc-d_yiO2hIJng7nRg2.css HTTP/1.1\r\nHost: cdn-jm-tools.web.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=utf-8\r\netag: \"180ed6b42ce49176e493ebf3f2145e670be96178b9e2f60001e81532e32268cb\"\r\nlast-modified: Sat, 25 Apr 2020 21:22:54 GMT\r\nstrict-transport-security: max-age=31556926; includeSubDomains; preload\r\naccept-ranges: bytes\r\ndate: Thu, 04 Jun 2026 11:29:11 GMT\r\nx-served-by: cache-hel1410032-HEL\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1780572552.538026,VS0,VE1\r\nvary: x-fh-requested-host, accept-encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 18705\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102041,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (61112)","md5":"53b33b15cf9dff288eda12099e0ee746","sha1":"1748b7bd3b89b84d800374083af646fec11ff082","sha256":"30c90ea15ddeec7d675ed3eaaf26e8283b908265c5a6a5ff00345d03c24233f0","sha512":"8ba4bcbe63b72e6dff001b441d0fe100ecb3a6a6d664816eac7d89e8bb088c6653c9f7bc646f20884842c19c7516ed751332e4585ff49202d4b3f73e6438f24d","ssdeep":"1536:IpHDgWeWJw+k4zazA/PWrF7qvEAFiQcpmeh1+zy35o:ORUyy3+","tlshash":"46a3c8946d243d269037c73561c1bd87a2121503f637aebbf6226db9cf896cb0b31e49","first_seen":"2023-04-05T03:19:57Z","last_seen":"2026-06-04T11:29:34.483922Z","times_seen":9917,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":57,"dns":17,"connect":13,"send":0,"wait":15,"receive":4,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"cdn-jm-tools.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn-jm-tools.web.app/d..p/others/mi..cro---t/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg","fqdn":"cdn-jm-tools.web.app","domain":"cdn-jm-tools.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","date":"2026-06-04T11:29:11.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.app","organization":""},"issuer":{"commonName":"WR4","organization":"Google Trust Services"},"validity":{"start":"Wed, 20 May 2026 17:14:17 GMT","end":"Tue, 18 Aug 2026 17:14:16 GMT"},"fingerprint":{"sha1":"45:CE:8E:05:99:1F:29:93:E3:1B:E1:2A:53:01:51:9E:33:30:9D:9B","sha256":"06:CB:0A:7C:41:2F:53:9C:E6:24:BF:F0:F5:45:4F:8A:4A:38:C5:4B:5E:F8:D6:F8:A7:FC:76:1B:1B:14:1A:CE"}}},"request":{"raw":"GET /d..p/others/mi..cro---t/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1\r\nHost: cdn-jm-tools.web.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=3600\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\netag: \"2084deafc36fbaca40a6352319b3c1edb1262245428033547de6b82e0c2dcfe8-br\"\r\nlast-modified: Sat, 25 Apr 2020 21:22:54 GMT\r\nstrict-transport-security: max-age=31556926; includeSubDomains; preload\r\naccept-ranges: bytes\r\ndate: Thu, 04 Jun 2026 11:29:11 GMT\r\nx-served-by: cache-hel1410032-HEL\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1780572552.539249,VS0,VE1\r\nvary: x-fh-requested-host, accept-encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 1274\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]}],"data":{"size":3651,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ee5c8d9fb6248c938fd0dc19370e90bd","sha1":"d01a22720918b781338b5bbf9202b241a5f99ee4","sha256":"04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a","sha512":"c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58","ssdeep":"","tlshash":"6371117b132887dae9d4a78c2e997b8d377095c4b1b24290874328a5bc086f7f038d60","first_seen":"2023-04-06T08:44:24Z","last_seen":"2026-07-25T15:52:16.881579Z","times_seen":127918,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":56,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"cdn-jm-tools.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn-jm-tools.web.app/d..p/others/mi..cro---t/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png","fqdn":"cdn-jm-tools.web.app","domain":"cdn-jm-tools.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","date":"2026-06-04T11:29:11.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.app","organization":""},"issuer":{"commonName":"WR4","organization":"Google Trust Services"},"validity":{"start":"Wed, 20 May 2026 17:14:17 GMT","end":"Tue, 18 Aug 2026 17:14:16 GMT"},"fingerprint":{"sha1":"45:CE:8E:05:99:1F:29:93:E3:1B:E1:2A:53:01:51:9E:33:30:9D:9B","sha256":"06:CB:0A:7C:41:2F:53:9C:E6:24:BF:F0:F5:45:4F:8A:4A:38:C5:4B:5E:F8:D6:F8:A7:FC:76:1B:1B:14:1A:CE"}}},"request":{"raw":"GET /d..p/others/mi..cro---t/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png HTTP/1.1\r\nHost: cdn-jm-tools.web.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=3600\r\ncontent-type: image/png\r\netag: \"a512441fed43fc63c5a2bbce213d4081532632f57c75eb60cb7dd0e4a1126b38\"\r\nlast-modified: Sat, 25 Apr 2020 21:22:54 GMT\r\nstrict-transport-security: max-age=31556926; includeSubDomains; preload\r\naccept-ranges: bytes\r\ndate: Thu, 04 Jun 2026 11:29:11 GMT\r\nx-served-by: cache-hel1410032-HEL\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1780572552.538769,VS0,VE1\r\nvary: x-fh-requested-host, accept-encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 240\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":240,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced","md5":"7cc096da6aa2dba3f81fcc1c8262157c","sha1":"a50776316f0220ed7cd7882a68c742a8861c999d","sha256":"ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83","sha512":"ec046758ec2d6588b9b103e5bb1b035dee57dfbb068ad902c869ed22b14f78282461709bdb20366ee887b814f00ae39a4ebd82db42bd831be85fe5b4bf4037af","ssdeep":"","tlshash":"a0d0979373129c2dcfb4e733920e0c22cc1382a3872ab74c58529050bf18c002a9085d","first_seen":"2023-04-27T20:18:37Z","last_seen":"2026-07-03T21:59:23.042776Z","times_seen":12253,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":54,"dns":0,"connect":0,"send":0,"wait":14,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"cdn-jm-tools.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","fqdn":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","domain":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.54.45","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-04T11:29:11.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 May 2026 06:57:47 GMT","end":"Mon, 10 Aug 2026 06:57:46 GMT"},"fingerprint":{"sha1":"24:D7:68:AF:FC:F2:DB:F6:04:47:7E:D0:7B:FF:F9:8E:74:18:97:12","sha256":"A7:D7:3C:F5:72:53:85:7E:A0:36:9A:EF:51:D0:3B:8B:FE:C9:91:D6:6C:42:05:07:D7:6C:7C:2E:4D:21:71:89"}}},"request":{"raw":"GET /mycarimage.html HTTP/1.1\r\nHost: pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 04 Jun 2026 11:29:11 GMT\r\nContent-Type: text/html\r\nContent-Length: 19427\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"202a56e5acfe31990db542a23b5bd5db\"\r\nLast-Modified: Thu, 23 Nov 2023 15:20:51 GMT\r\nServer: cloudflare\r\nCF-RAY: a066992c38e4120a-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:3.5.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}],"data":{"size":19427,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (19152), with CRLF line terminators","md5":"202a56e5acfe31990db542a23b5bd5db","sha1":"30eb07419e3797b2fa46bc9449fbcf1be828e651","sha256":"2cc4e71ac843912ede37b080e8a417c9e1b62c7d4ebe07dbf6d80450ee6a8d3e","sha512":"ca1a3b597cf1a69ca866c91b37f7a7bbe1bedd8b8392e65dfc0127821e55ddfde09fa43505b42b3a5c26598c5085d3d7e24e4dbe5d65572c80306bdcc2591819","ssdeep":"384:h7i76pyKJ7eFJ7ecR7ec47Dd7747R7RqytPhgTwZe08B7W7L7m7J7L7GqMsc7eoC:h2OFCDCcRCcQNEldtOi1KCXStXyaTT","tlshash":"e992f9f2b0111e6a53ab9df9f033d200713ae64cd3035d60e97c8a9416ffe19f52699a","first_seen":"2023-11-22T13:20:56Z","last_seen":"2026-06-04T11:29:34.487415Z","times_seen":590,"resource_available":true,"data":null}},"time_used":210,"timings":{"blocked":19,"dns":0,"connect":1,"send":0,"wait":171,"receive":1,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-04","alert":"Phishing Block","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn-jm-tools.web.app/d..p/others/mi..cro---t/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg","fqdn":"cdn-jm-tools.web.app","domain":"cdn-jm-tools.web.app","tld":"web.app"},"ip":{"addr":"199.36.158.100","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/mycarimage.html","date":"2026-06-04T11:29:11.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.app","organization":""},"issuer":{"commonName":"WR4","organization":"Google Trust Services"},"validity":{"start":"Wed, 20 May 2026 17:14:17 GMT","end":"Tue, 18 Aug 2026 17:14:16 GMT"},"fingerprint":{"sha1":"45:CE:8E:05:99:1F:29:93:E3:1B:E1:2A:53:01:51:9E:33:30:9D:9B","sha256":"06:CB:0A:7C:41:2F:53:9C:E6:24:BF:F0:F5:45:4F:8A:4A:38:C5:4B:5E:F8:D6:F8:A7:FC:76:1B:1B:14:1A:CE"}}},"request":{"raw":"GET /d..p/others/mi..cro---t/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg HTTP/1.1\r\nHost: cdn-jm-tools.web.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pub-1c3a35bc3f574b6684c3e0a322c562b4.r2.dev/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=3600\r\ncontent-encoding: br\r\ncontent-type: image/svg+xml\r\netag: \"cf034e803491c0dbb1074332cd18fac418b94b0a139a7ddbf92ec40574951a8a-br\"\r\nlast-modified: Sat, 25 Apr 2020 21:22:54 GMT\r\nstrict-transport-security: max-age=31556926; includeSubDomains; preload\r\naccept-ranges: bytes\r\ndate: Thu, 04 Jun 2026 11:29:11 GMT\r\nx-served-by: cache-hel1410032-HEL\r\nx-cache: HIT\r\nx-cache-hits: 0\r\nx-timer: S1780572552.538875,VS0,VE1\r\nvary: x-fh-requested-host, accept-encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 230\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Firebase","description":"Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.","website":"https://firebase.google.com","common_platform_enumeration":"cpe:2.3:a:google:firebase_cloud_messaging:*:*:*:*:*:*:*:*","icon":"Firebase.svg","categories":["Databases","Development"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":915,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2b5d393db04a5e6e1f739cb266e65b4c","sha1":"6a435df5cac3d58ccad655fe022ccf3dd4b9b721","sha256":"16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6","sha512":"3a692635ee8ebd7b15930e78d9e7e808e48c7ed3ed79003b8ca6f9290fa0e2b0fa3573409001489c00fb41d5710e75d17c3c4d65d26f9665849fb7406562a406","ssdeep":"","tlshash":"4211c9bb2f78c66ea09197943762a7791f76a14873883590f3432f11ee44dbb203dc40","first_seen":"2023-04-14T08:32:49Z","last_seen":"2026-07-21T18:54:47.677247Z","times_seen":15824,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":52,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-04","alert":"Sinkholed","trigger":"cdn-jm-tools.web.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}