{"report_id":"40ba3668-b1d2-43d1-861d-89f5de24378d","version":0,"status":"done","tags":[],"date":"2026-08-12T01:21:38Z","url":{"schema":"http","addr":"financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"44.254.215.66","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"title":"Microsoft Login Page","dom":{"size":38715,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (2264)","md5":"bc948bd5c7279afd7b9dd3ded55307f1","sha1":"529c90faa59e8c9cbd43beb7ca983227924ce60d","sha256":"fa0643098a318e2e18f5e3da53cda0df2cdcfe9fe69a5e15220e49101c7890b8","sha512":"4c1cda301ac36d26ccd34ad99964443ec6849c831235c0b25c3239a60f7b9e45b8688bef06ebe737ebb770b7ab5db94266d04531d3e2a3bc3606439bbe64dc12","ssdeep":"192:TeC6HZtNvygNZXjsJz5EP9qZbzak4cYXBxxxURmqgnq7qFHXEUJ6sTchymhny:TafZXjy5+qd4cYNxURmlqlQ6sAPly","tlshash":"ef0343e27c134bf7854e86a931702ed171e2d80bad4dbe61ba4cdfd12be820ee564453","dom_hash":"domhashecfbb7b7443cefa0e33843e7697b6451","first_seen":"2026-08-06T16:11:41.75301Z","last_seen":"2026-08-12T08:59:46.04622Z","times_seen":5,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"44.254.215.66","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-16T01:21:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"financialhealthsupport.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"aadcdn.msftauth.net","ip":{"addr":"95.101.11.170","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2018-10-25","domain_rank":5262,"first_seen":"2018-11-19T10:50:32Z","last_seen":"2026-08-10T15:00:17.150327Z","alert_count":0,"request_count":4,"received_data":8050,"sent_data":2439,"comment":"","tags":null,"fingerprints":null},{"fqdn":"financialhealthsupport.com","ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":1752244,"first_seen":"No data","last_seen":"No data","alert_count":6,"request_count":6,"received_data":135839,"sent_data":3266,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"financialhealthsupport.com/static/training/js/jquery-3.6.1.min.js","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9bdfd807c7561b5a4eb97516f348321","sha1":"0fa72756e48c33a6feeace1ffa5d790d58b53729","sha256":"131c0d82967fed05e1920e519e0ea6ec91ab97b7c40480f72f8af8680bba1f0a","sha512":"6835341096366b0588602309e43696cbfafbbedaa323e1958f6e7dc5ff3a4a1482370f4ccfb62b63be082e15f6cb26b43068e0228406742aab0c43a0d3a7f0a7","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvu:SdeIygP3fulzcsz8jlvaDioQ47GKf","tlshash":"6493f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","size":89663,"data":"","first_seen":"2023-03-07T22:57:17Z","last_seen":"2026-08-13T12:33:51.902781Z","times_seen":3396,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/static/training/js/create_click_event.js","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e609787d1a31112c3c5ea9b99ace89ad","sha1":"92e78c74ea8987bbfecc4fc0e72190d827422052","sha256":"8aa0dc07e67658e85b668f449655068ffeadaa406a21115acae58dc176c4487b","sha512":"db933e74d33e484ca7f9d8ce766a7b3f0e95ccf123a5062549873c30dbf68a169b839a891ab9465936dc76979c25a2544e5000248f857cd417eb95590fbb8d58","ssdeep":"","tlshash":"62e06185744d191e443f30770f3f148ed0bc3ea25d6288d1a05c68c9958552c1314480","size":376,"data":"","first_seen":"2023-03-08T14:45:10Z","last_seen":"2026-08-12T08:59:46.073017Z","times_seen":139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/static/training/js/confirm_data_entry_on_typing.js","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e9dd0f7caf934646721b82f33b143344","sha1":"549da0a450fb65d7e703ed54f08a29e6c3253b16","sha256":"17843d06395a6f2138b2baeef4b25ebb04cd963a4d4cbd13457be3b0c5d88865","sha512":"6105a1e7cf1249327d01a90b7ce5d326a83ece36c5098794ee3e6c3ab33f04ac5c712cff0951e6a1e259ef8917c4986846cf80445880d9d93eaa89f4049fb66c","ssdeep":"","tlshash":"d5211196664c2383de68a2be1f1db1eea67d11b84e00c0245e4b1f6c737c95c2e549d3","size":1386,"data":"","first_seen":"2026-03-09T23:38:12.652529Z","last_seen":"2026-08-12T08:59:46.081965Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"4ff1a58b5d4dbdadcfc21b97411be1e9","sha1":"3733faf5c9dcec8e171c6359fbe4f3a5c3998f4c","sha256":"7a23b78c88f8e661b89d469d677fde0c2a52a956d5c1c85e31929a7df8bdc504","sha512":"ae173e8a293fe439e5c352afb635b599222944859f11910afc40c996720e59b8aa66fdddcb932627e528008dedcfb64eaabe5b3ddf47a2da7f63955fa6389211","ssdeep":"","tlshash":"96c04c5064e6022e95154082913aa35298faf0ee915b911bdbc55dd8f60c1765aa4430","size":143,"data":"","first_seen":"2026-06-14T01:45:15.33893Z","last_seen":"2026-08-12T08:59:46.088093Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"aadcdn.msftauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg","fqdn":"aadcdn.msftauth.net","domain":"msftauth.net","tld":"net"},"ip":{"addr":"95.101.11.170","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.484Z","timestamp":1786497671484,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"idnaakamaicdn.msftauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 ECC CA OCSP 02","organization":"Microsoft Corporation"},"validity":{"start":"Tue, 10 Feb 2026 18:29:15 GMT","end":"Fri, 05 Feb 2027 18:29:15 GMT"},"fingerprint":{"sha1":"11:6E:B1:51:6A:18:5E:8A:A2:FA:F0:B4:38:78:7E:52:0D:55:06:B5","sha256":"26:06:65:FC:25:8B:05:0E:C1:76:C6:E2:3C:FF:76:A2:A3:52:4E:8D:FC:2D:48:D0:74:7E:6E:33:DA:49:4A:3D"}}},"request":{"raw":"GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1\r\nHost: aadcdn.msftauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-length: 321\r\ncontent-type: text/html\r\nx-ms-error-code: WebContentNotFound\r\nx-ms-request-id: 911f7cc2-701e-00c1-4ef8-29f32c000000\r\nx-ms-version: 2018-03-28\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-version\r\naccess-control-allow-origin: *\r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\nakamai-grn: 0.4d772117.1786497671.3260e82b\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T18:51:39.072062Z","times_seen":17874979,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/favicon.ico","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.853Z","timestamp":1786497671853,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: financialhealthsupport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nserver: nginx\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nx-pod-name: production-is-worker-webapp-spot-8666f8c58f-tv5sq\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":575,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-13T18:43:33.669768Z","times_seen":550495,"resource_available":true,"data":null}},"time_used":176,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"financialhealthsupport.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/static/training/js/confirm_data_entry_on_typing.js","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.468Z","timestamp":1786497671468,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /static/training/js/confirm_data_entry_on_typing.js HTTP/1.1\r\nHost: financialhealthsupport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 1386\r\nserver: nginx\r\nlast-modified: Mon, 10 Aug 2026 10:40:29 GMT\r\netag: \"6a79aa9d-56a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nx-pod-name: production-is-worker-webapp-spot-8666f8c58f-kqslh\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1386,"size_decoded":2016,"mime_type":"application/javascript","magic":"ASCII text","md5":"e9dd0f7caf934646721b82f33b143344","sha1":"549da0a450fb65d7e703ed54f08a29e6c3253b16","sha256":"17843d06395a6f2138b2baeef4b25ebb04cd963a4d4cbd13457be3b0c5d88865","sha512":"6105a1e7cf1249327d01a90b7ce5d326a83ece36c5098794ee3e6c3ab33f04ac5c712cff0951e6a1e259ef8917c4986846cf80445880d9d93eaa89f4049fb66c","ssdeep":"","tlshash":"d5211196664c2383de68a2be1f1db1eea67d11b84e00c0245e4b1f6c737c95c2e549d3","first_seen":"2026-03-09T23:38:12.652529Z","last_seen":"2026-08-12T08:59:46.081965Z","times_seen":29,"resource_available":true,"data":null}},"time_used":351,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":351,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"financialhealthsupport.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg","fqdn":"aadcdn.msftauth.net","domain":"msftauth.net","tld":"net"},"ip":{"addr":"95.101.11.170","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.481Z","timestamp":1786497671481,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"idnaakamaicdn.msftauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 ECC CA OCSP 02","organization":"Microsoft Corporation"},"validity":{"start":"Tue, 10 Feb 2026 18:29:15 GMT","end":"Fri, 05 Feb 2027 18:29:15 GMT"},"fingerprint":{"sha1":"11:6E:B1:51:6A:18:5E:8A:A2:FA:F0:B4:38:78:7E:52:0D:55:06:B5","sha256":"26:06:65:FC:25:8B:05:0E:C1:76:C6:E2:3C:FF:76:A2:A3:52:4E:8D:FC:2D:48:D0:74:7E:6E:33:DA:49:4A:3D"}}},"request":{"raw":"GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1\r\nHost: aadcdn.msftauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-length: 1435\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\ncontent-md5: nzaLxFgP7ZB3dfMcaybWzw==\r\nlast-modified: Wed, 15 Jan 2025 17:53:51 GMT\r\naccept-ranges: bytes\r\netag: \"0x8DD358D925D93F3\"\r\nx-ms-request-id: 876783be-d01e-003c-27d8-0f7d09000000\r\nx-ms-version: 2018-03-28\r\naccess-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=25778140\r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\nvary: Accept-Encoding\r\nakamai-grn: 0.4d772117.1786497671.3260e829\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":3651,"size_decoded":2114,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ee5c8d9fb6248c938fd0dc19370e90bd","sha1":"d01a22720918b781338b5bbf9202b241a5f99ee4","sha256":"04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a","sha512":"c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58","ssdeep":"","tlshash":"6371117b132887dae9d4a78c2e997b8d377095c4b1b24290874328a5bc086f7f038d60","first_seen":"2023-04-06T08:44:24Z","last_seen":"2026-08-13T18:21:06.167088Z","times_seen":128384,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":239,"dns":0,"connect":2,"send":0,"wait":3,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg","fqdn":"aadcdn.msftauth.net","domain":"msftauth.net","tld":"net"},"ip":{"addr":"95.101.11.170","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.488Z","timestamp":1786497671488,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"idnaakamaicdn.msftauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 ECC CA OCSP 02","organization":"Microsoft Corporation"},"validity":{"start":"Tue, 10 Feb 2026 18:29:15 GMT","end":"Fri, 05 Feb 2027 18:29:15 GMT"},"fingerprint":{"sha1":"11:6E:B1:51:6A:18:5E:8A:A2:FA:F0:B4:38:78:7E:52:0D:55:06:B5","sha256":"26:06:65:FC:25:8B:05:0E:C1:76:C6:E2:3C:FF:76:A2:A3:52:4E:8D:FC:2D:48:D0:74:7E:6E:33:DA:49:4A:3D"}}},"request":{"raw":"GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1\r\nHost: aadcdn.msftauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-length: 673\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\ncontent-md5: DhdidjYrlCeaRJJRG/y9mA==\r\nlast-modified: Wed, 15 Jan 2025 17:54:26 GMT\r\naccept-ranges: bytes\r\netag: \"0x8DD358DA72AAF33\"\r\nx-ms-request-id: 6201355c-701e-00d1-5a1c-023644000000\r\nx-ms-version: 2018-03-28\r\naccess-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=27153409\r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\nvary: Accept-Encoding\r\nakamai-grn: 0.4d772117.1786497671.3260e82a\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":1864,"size_decoded":1351,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bc3d32a696895f78c19df6c717586a5d","sha1":"9191cb156a30a3ed79c44c0a16c95159e8ff689d","sha256":"0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68","sha512":"8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64","ssdeep":"","tlshash":"4e310059c51d3566ec04c3aceae1d468315e71efa8a581c961849b3f95b0dce0eccb70","first_seen":"2023-04-12T23:20:27Z","last_seen":"2026-08-12T08:59:46.069874Z","times_seen":103814,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":239,"dns":0,"connect":2,"send":0,"wait":5,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/tracking/create_click_event/6197094-oH1faBZb-PKS9Q","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.868Z","timestamp":1786497671868,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"POST /tracking/create_click_event/6197094-oH1faBZb-PKS9Q HTTP/1.1\r\nHost: financialhealthsupport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q\r\nContent-Type: application/json; charset=utf-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 47\r\nOrigin: https://financialhealthsupport.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":47,"data":"{\"should_create_security_training_event\":false}"}},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\ncontent-type: application/json\r\ncontent-length: 21\r\nserver: nginx\r\ncache-control: no-store\r\npragma: no-cache\r\ncontent-security-policy: style-src * 'unsafe-inline'; object-src 'self' ironscales-deepfake-production.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.ironscales.com *.eu.pendo.io *.pendo.io *.googletagmanager.com *.google-analytics.com *.googleapis.com *.google.com *.gstatic.com *.statuspage.io *.sentry-cdn.com code.jquery.com cdn.jsdelivr.net appsforoffice.microsoft.com d.bablic.com edge.bablic.com staticmediafiles.s3.amazonaws.com platform.instagram.com wwwimages.adobe.com ajax.aspnetcdn.com cdnjs.cloudflare.com/ajax/libs/select2/4.0.5/js/select2.min.js *.wistia.com *.wistia.net *.ironscales.io; connect-src * webpack:; default-src 'self'; font-src *; frame-src 'self' *.google.com ironscales.com *.ironscales.com *.eu.ironscales.com *.eu.pendo.io *.pendo.io *.youtube.com 4hyb9xl50gtg.statuspage.io ironscales-deepfake-production.s3.amazonaws.com *.wizer-training.com *.hsforms.com; img-src * data: blob:; media-src * blob:\r\nvary: Cookie\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nx-pod-name: production-is-worker-webapp-spot-8666f8c58f-dfnvf, production-is-worker-webapp-spot-8666f8c58f-dfnvf\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":21,"size_decoded":1623,"mime_type":"application/json","magic":"JSON text data","md5":"79be822f7304ffaaeb68aa8b0336848b","sha1":"acc79c84f5cdcf1277d8aa905e6290b70c65e862","sha256":"8e348a2876686697c17bc2784470cbebe761146f0bbfc180a67a52793117882d","sha512":"5b99db9af37dc7ed829b620a204db7eb53af1d85768be0cd3c7fa98646bf9bd5c8ac26144c0b059f05498e927456179e51ccddf8364d15a793811d1040ab20a8","ssdeep":"","tlshash":"b1700002000800a208c0f80000020c323aa08a20800a00c8802c00288a080c0a88a000","first_seen":"2023-04-06T07:58:11Z","last_seen":"2026-08-12T22:25:35.681398Z","times_seen":670,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"financialhealthsupport.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-12T01:21:10.148Z","timestamp":1786497670148,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /6197094-oH1faBZb-PKS9Q HTTP/1.1\r\nHost: financialhealthsupport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 12 Aug 2026 01:21:10 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 38711\r\nserver: nginx\r\ncache-control: no-store\r\npragma: no-cache\r\ncontent-security-policy: frame-src 'self' *.google.com ironscales.com *.ironscales.com *.eu.ironscales.com *.eu.pendo.io *.pendo.io *.youtube.com 4hyb9xl50gtg.statuspage.io ironscales-deepfake-production.s3.amazonaws.com *.wizer-training.com *.hsforms.com; font-src *; object-src 'self' ironscales-deepfake-production.s3.amazonaws.com; style-src * 'unsafe-inline'; default-src 'self'; connect-src * webpack:; img-src * data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.ironscales.com *.eu.pendo.io *.pendo.io *.googletagmanager.com *.google-analytics.com *.googleapis.com *.google.com *.gstatic.com *.statuspage.io *.sentry-cdn.com code.jquery.com cdn.jsdelivr.net appsforoffice.microsoft.com d.bablic.com edge.bablic.com staticmediafiles.s3.amazonaws.com platform.instagram.com wwwimages.adobe.com ajax.aspnetcdn.com cdnjs.cloudflare.com/ajax/libs/select2/4.0.5/js/select2.min.js *.wistia.com *.wistia.net *.ironscales.io; media-src * blob:\r\nvary: Cookie\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nx-pod-name: production-is-worker-webapp-spot-8666f8c58f-ctzcl, production-is-worker-webapp-spot-8666f8c58f-ctzcl\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"jQuery:3.6.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":38711,"size_decoded":40324,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (2264)","md5":"f19a739d2eb431ef7fceb09f91d8bdeb","sha1":"3a0a2b5c005c14dc784b0e3b7be6504d238481b1","sha256":"e7162226134e2da2d44fcbb8e20d16c79789513d67e6fd400be7241852a70ce1","sha512":"ae3e36eaf89cef5c9442f6c852f2275791779e0156ac4442401e34fa7fa093568408c8aa665c593ba1473bef5939e734b80a1a6ce44b85d024557fafc1c452eb","ssdeep":"192:TeqHZtTvygNZXgsJz5EP9qZbzak4cYXBxxxURpqggq7qFHXEUK6sTFhymhny:THFZXgy5+qd4cYNxURplfl96sJPly","tlshash":"f50342e27c134bf7854e86a931702dd172e2d807ad4dbe61ba4cdfd12be820ee564453","first_seen":"2026-08-06T16:11:41.757789Z","last_seen":"2026-08-12T08:59:46.054472Z","times_seen":5,"resource_available":false,"data":null}},"time_used":1048,"timings":{"blocked":-1,"dns":31,"connect":168,"send":0,"wait":337,"receive":168,"ssl":343},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"financialhealthsupport.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ty_bk5wxx82kilmq7o6qlw2.css","fqdn":"aadcdn.msftauth.net","domain":"msftauth.net","tld":"net"},"ip":{"addr":"95.101.11.170","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.462Z","timestamp":1786497671462,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"idnaakamaicdn.msftauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 ECC CA OCSP 02","organization":"Microsoft Corporation"},"validity":{"start":"Tue, 10 Feb 2026 18:29:15 GMT","end":"Fri, 05 Feb 2027 18:29:15 GMT"},"fingerprint":{"sha1":"11:6E:B1:51:6A:18:5E:8A:A2:FA:F0:B4:38:78:7E:52:0D:55:06:B5","sha256":"26:06:65:FC:25:8B:05:0E:C1:76:C6:E2:3C:FF:76:A2:A3:52:4E:8D:FC:2D:48:D0:74:7E:6E:33:DA:49:4A:3D"}}},"request":{"raw":"GET /ests/2.1/content/cdnbundles/converged.v2.login.min_ty_bk5wxx82kilmq7o6qlw2.css HTTP/1.1\r\nHost: aadcdn.msftauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/\r\nOrigin: https://financialhealthsupport.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-length: 321\r\ncontent-type: text/html\r\nx-ms-error-code: WebContentNotFound\r\nx-ms-request-id: d0f6f478-b01e-0072-80f8-29cd63000000\r\nx-ms-version: 2018-03-28\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,x-ms-error-code,x-ms-request-id,x-ms-version\r\naccess-control-allow-origin: *\r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\nakamai-grn: 0.a60b655f.1786497671.6d67174\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":321,"size_decoded":749,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (321), with no line terminators","md5":"8cc91bd5e07d25762368d2004d3054c8","sha1":"0ed8fc8dba107e64ece545da019af35b7b4696d4","sha256":"ea7da843806f28c581c2d19f79713652b8a3594a668f01e79b57bbaeb8131417","sha512":"1a0d422863ca2642fc0cf1adca0b5c74c15282ffac9b26e6f69aed4583947a1315001cb35a703cc2f19b07139b3aa129423f5048dea264d717a95cb3638f8671","ssdeep":"","tlshash":"bfe026ad41421028ea2171a48da1b3a47c4eb67270a343a22d846f8cbad4380dd86b5f","first_seen":"2026-08-12T01:21:42.698415Z","last_seen":"2026-08-12T01:21:42.698415Z","times_seen":1,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":2,"connect":1,"send":0,"wait":247,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/static/training/js/jquery-3.6.1.min.js","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.465Z","timestamp":1786497671465,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /static/training/js/jquery-3.6.1.min.js HTTP/1.1\r\nHost: financialhealthsupport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 89663\r\nserver: nginx\r\nlast-modified: Mon, 10 Aug 2026 10:40:29 GMT\r\netag: \"6a79aa9d-15e3f\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nx-pod-name: production-is-worker-webapp-spot-8666f8c58f-jprc7\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89663,"size_decoded":90296,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"f9bdfd807c7561b5a4eb97516f348321","sha1":"0fa72756e48c33a6feeace1ffa5d790d58b53729","sha256":"131c0d82967fed05e1920e519e0ea6ec91ab97b7c40480f72f8af8680bba1f0a","sha512":"6835341096366b0588602309e43696cbfafbbedaa323e1958f6e7dc5ff3a4a1482370f4ccfb62b63be082e15f6cb26b43068e0228406742aab0c43a0d3a7f0a7","ssdeep":"1536:SjjxXUHJnxDjoXEZxkMV4PYDt0zxxf6gP3f8cApoEGOzZTBvUsuy8WnKdXwhLQvu:SdeIygP3fulzcsz8jlvaDioQ47GKf","tlshash":"6493f8ddb2c6702247a770ba007f510bf236199d684d8450f269d8e9bc78a4e827bf7d","first_seen":"2023-03-07T22:57:17Z","last_seen":"2026-08-13T12:33:51.902781Z","times_seen":3396,"resource_available":true,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":175,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"financialhealthsupport.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"financialhealthsupport.com/static/training/js/create_click_event.js","fqdn":"financialhealthsupport.com","domain":"financialhealthsupport.com","tld":"com"},"ip":{"addr":"52.40.99.43","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q","date":"2026-08-12T01:21:11.466Z","timestamp":1786497671466,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"account-info.email","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Mon, 16 Feb 2026 00:00:00 GMT","end":"Wed, 17 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"ED:C5:F4:5F:4E:20:D6:D7:76:52:C7:18:8C:23:01:87:7F:16:B9:1C","sha256":"3C:7F:4B:4A:1E:D9:CF:A1:06:2A:47:95:DE:E1:7C:7C:7F:6F:72:E5:CA:7E:7E:2A:87:D6:8C:86:79:95:17:9F"}}},"request":{"raw":"GET /static/training/js/create_click_event.js HTTP/1.1\r\nHost: financialhealthsupport.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://financialhealthsupport.com/6197094-oH1faBZb-PKS9Q\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 12 Aug 2026 01:21:11 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 376\r\nserver: nginx\r\nlast-modified: Mon, 10 Aug 2026 10:40:29 GMT\r\netag: \"6a79aa9d-178\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-ua-compatible: IE=edge,chrome=1\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: interest-cohort=(), camera=(), microphone=(), usb=(), payment=()\r\nx-pod-name: production-is-worker-webapp-spot-8666f8c58f-jpcgf\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":376,"size_decoded":1005,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"e609787d1a31112c3c5ea9b99ace89ad","sha1":"92e78c74ea8987bbfecc4fc0e72190d827422052","sha256":"8aa0dc07e67658e85b668f449655068ffeadaa406a21115acae58dc176c4487b","sha512":"db933e74d33e484ca7f9d8ce766a7b3f0e95ccf123a5062549873c30dbf68a169b839a891ab9465936dc76979c25a2544e5000248f857cd417eb95590fbb8d58","ssdeep":"","tlshash":"62e06185744d191e443f30770f3f148ed0bc3ea25d6288d1a05c68c9958552c1314480","first_seen":"2023-03-08T14:45:10Z","last_seen":"2026-08-12T08:59:46.073017Z","times_seen":139,"resource_available":true,"data":null}},"time_used":351,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":351,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-12","alert":"Sinkholed","trigger":"financialhealthsupport.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}