{"report_id":"40cd3a85-c3b6-45bb-ac72-db03d2fb613d","version":0,"status":"done","tags":["wetransfer","phishing","financial"],"date":"2026-08-27T22:31:15Z","url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.223.49","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"title":"WeTransfer","dom":{"size":613580,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (62962)","md5":"a415f5f3ed99b8bc53b962d30fc94b0e","sha1":"fa51486b4f93394f28f4997475e48264035c0837","sha256":"2b199b33274b57b1273dc2fdb7ddaa504fae867ee817bae494313e06318d885b","sha512":"c6af7a290d3fd013888829acf6d7cd66f0419d2cd59bce0758a48634132643e3d030c07f90677437dd4b7eb3ab1e6d243b201b488dc61944e76bb01834599ada","ssdeep":"12288:gkTBMXjRSZEq1juWQO1iJD5WvOPWLodo4m:gC9ZEqBuWQO1iJD5WvF","tlshash":"23d46b36a6691914db7bcab6b5c1fe943c24ed13c143d4d8f28563accac722507f2b1a","dom_hash":"domhash1d82d5e04484e313fda2920ccc5334de","first_seen":"2026-08-27T16:32:55.263902Z","last_seen":"2026-08-27T22:31:18.021015Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.223.49","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-01T22:31:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]},"summary":[{"fqdn":"maxcdn.bootstrapcdn.com","ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":6807,"first_seen":"2014-06-18T00:37:31Z","last_seen":"2026-08-24T08:35:23.813318Z","alert_count":0,"request_count":2,"received_data":99754,"sent_data":1018,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.1.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-08-24T00:24:08.232807Z","alert_count":0,"request_count":2,"received_data":140478,"sent_data":980,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-08-24T08:39:13.43974Z","alert_count":0,"request_count":2,"received_data":173104,"sent_data":994,"comment":"","tags":null,"fingerprints":null},{"fqdn":"s3.us-east-1.amazonaws.com","ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2017-11-22T15:47:32Z","last_seen":"2026-08-21T02:06:05.663212Z","alert_count":46,"request_count":23,"received_data":626372,"sent_data":11894,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"Snowplow Analytics","description":"Snowplow is an open-source behavioral data management platform for businesses.","website":"https://snowplowanalytics.com","common_platform_enumeration":"","icon":"Snowplow.svg","categories":["Analytics","IaaS"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Popper:1.12.9","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"Bootstrap:4.1.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"BootstrapCDN:4.1.3","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}]},{"fqdn":"prod-cdn.wetransfer.net","ip":{"addr":"13.249.8.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2009-02-02","domain_rank":760029,"first_seen":"2018-10-23T08:53:42Z","last_seen":"2026-08-26T23:06:09.391818Z","alert_count":0,"request_count":5,"received_data":152450,"sent_data":3034,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"stackpath.bootstrapcdn.com","ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":21970,"first_seen":"2018-04-05T04:41:29Z","last_seen":"2026-08-24T12:57:49.129453Z","alert_count":0,"request_count":3,"received_data":155919,"sent_data":1524,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"mk2-b4c8d3.ingress-earth.ewp.live","ip":{"addr":"63.250.43.128","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"domain_registered":"2022-05-26","domain_rank":0,"first_seen":"2022-08-12T11:46:38Z","last_seen":"2026-08-26T23:06:10.002019Z","alert_count":8,"request_count":4,"received_data":60914,"sent_data":2380,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-23T22:47:41.849275Z","alert_count":0,"request_count":2,"received_data":40386,"sent_data":1030,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d2ef49a5b8e8ff58138ac968a35812e1","sha1":"925b821365cdbe6aa990d018b16a8bcb4c69fa1a","sha256":"5826a4dc51fb42fa34847b498a5e18448c3093cd9379a5e4c04fbe646416a4f6","sha512":"d6635d9feb4e712472dc488c53802cffd4b988cfd07a31c5a50a8a750e30b3c0b02776a8d988b77fefc01ddc4fe859d12d6171ed09c3d9720477c520aeac1fd9","ssdeep":"","tlshash":"3dc080b77beb053105efb57f1420474c3434c40c2d0163092d3c8474c435de7643aa89","size":177,"data":"","first_seen":"2026-07-06T11:26:25.619878Z","last_seen":"2026-08-27T22:31:18.092586Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"010dac5d4a5f41b2a997b0ebb2b74da3","sha1":"004ba2f343f8ea90a3f144850481d62c173e0af8","sha256":"ff86117ef0c10b94f9464ce65556dd81e4278bd0d301f09cb14e3baabc874737","sha512":"911759c44ae2893c1bdc6aec66017befdb4fb634baf06279b6dc01705cfec4c08e20191cfaff651d7fde60f61ce84015b834e0c4295f615b98d00f8d142271da","ssdeep":"","tlshash":"f1d05ef772e615b00bde76ef182287497c78c8345c152054ac6c84719074e9554aaa94","size":253,"data":"","first_seen":"2026-07-04T21:20:12.170717Z","last_seen":"2026-08-27T22:31:18.094706Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"70c0f06ea21eb7712bb7b12cfd72d964","sha1":"28315c0e6ebc734949a7557471f9da428e69199e","sha256":"561f0e10a458740c9c1ab6d5af3837a19fd427adcc5539a6102def6653380ea4","sha512":"688a5cd5dd80d1317d92d66ca1974c9afa927b463adf7a2ce30ea778d6c14f5c849356b14fb50d431d818a2c8f067d9d638de75c9c4b85bb32e94d15c47c1c5d","ssdeep":"","tlshash":"36e07d0c18702330826f1003c89ea9c06de617c46027d0d1c0cd5c5154a0d3fd17fda2","size":311,"data":"","first_seen":"2026-07-14T02:22:24.076491Z","last_seen":"2026-08-27T22:31:18.095577Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"b303fd67446f5cfe588e82cd17deb167","sha1":"36c49849276ba5592f57fdcb9b11f4819d0265ed","sha256":"8b08353e20d3c13c7e82bf884ed992bed040d4fd6d22271caca43b30ea2065ec","sha512":"c2f9345c9f3d1bf2ad152b97a5531ce5e6510344cf5a5e78589610d8d6c7916b0f0a3359c59ee0745cbad38fb491336f06465df9e99e4f242d9d609809f84c3a","ssdeep":"","tlshash":"ea412455f09126a5057320fd29bf924536e2898b1604ee4439ac8588bf7cf2fbd72187","size":2266,"data":"","first_seen":"2026-08-26T23:06:13.277916Z","last_seen":"2026-08-27T22:31:18.096946Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.2.1.slim.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.1.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5f48fc77cac90c4778fa24ec9c57f37d","sha1":"9e89d1515bc4c371b86f4cb1002fd8e377c1829f","sha256":"9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398","sha512":"cab8c4afa1d8e3a8b7856ee29ae92566d44ceead70c8d533f2c98a976d77d0e1d314719b5c6a473789d8c6b21ebb4b89a6b0ec2e1c9c618fb1437ebc77d3a269","ssdeep":"1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT","tlshash":"b663d5d9b2c67062db7730b950bf410bf07a98dab44c8c60e198d8d47d78a99817bf2d","size":69597,"data":"","first_seen":"2023-03-07T01:02:43Z","last_seen":"2026-08-28T05:20:34.614307Z","times_seen":81302,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85578,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-28T05:24:49.157381Z","times_seen":295475,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"70d3fda195602fe8b75e0097eed74dde","sha1":"c3b977aa4b8dfb69d651e07015031d385ded964b","sha256":"a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66","sha512":"51affb5a8cfd2f93b473007f6987b19a0a1a0fb970ddd59ef45bd77a355d82abbbd60468837a09823496411e797f05b1f962ae93c725ed4c00d514ba40269d14","ssdeep":"384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f","tlshash":"1c82a3cc3291b06643a79167a06f960fb2339979614e9410f199f2d87c70ef9913fc7a","size":19188,"data":"","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:20:34.61732Z","times_seen":111599,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"67176c242e1bdc20603c878dee836df3","sha1":"27a71b00383d61ef3c489326b3564d698fc1227c","sha256":"56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4","sha512":"9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a","ssdeep":"768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+","tlshash":"3533b649725078b201df9176913f460bb736788ea907816cb95d98ed2e7cd89322bf3c","size":51039,"data":"","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:20:34.630514Z","times_seen":126584,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"14d449eb8876fa55e1ef3c2cc52b0c17","sha1":"a9545831803b1359cfeed47e3b4d6bae68e40e99","sha256":"e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b","sha512":"00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22","ssdeep":"768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B","tlshash":"7523c84a7254b4a202dfa476913f450bb73b389aa60bc16cb95994ed1d7cd8c3227f3c","size":48944,"data":"","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:25:03.344249Z","times_seen":111220,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/analytics.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.807Z","timestamp":1787869839807,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/analytics.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNER7ZY9T3EXZZW3\r\nx-amz-id-2: PKm0AYFnsvKbELilj6KohWcvk0jreR4dIx0XnbHRrTIAafLxO8DYnteLZ6hCLBJ/OHURAVR+0Wplq+6AKc/q8fIW/KwvAC8X\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:40 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"d303f72f75d94588abbee72c399fdd04","sha1":"d39d5fdad61f70af77aee79c348ce25c893b3fdf","sha256":"f9a95833248b413974e3b80e524dff10f77ca74380c181a453fbe262f0c68b30","sha512":"109e0ff1a234904d698d3c594562ce7e9685ee183a92e8e0c54bba65b2b31563f734adce523db0cdc3f394cfd4b56835b4316b2f2a0dae149cdc7e0a2accc919","ssdeep":"","tlshash":"1ad02b12b3d4241249598965523bd6219b8c893133e016b9ebc165431b622d18e78160","first_seen":"2026-08-27T22:31:18.024217Z","last_seen":"2026-08-27T22:31:18.024217Z","times_seen":1,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":-1,"dns":0,"connect":96,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/gtm_002.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.809Z","timestamp":1787869839809,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/gtm_002.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEGC1Z2HZ9TVXQ8\r\nx-amz-id-2: kAxC3eJONtWPpt0d2ONw7EpD1hppJljt0siGKqJRmjGhd4CkJlgdSWbASbFQJBb6HZ7TwNu83S43xenJl8hgej/+K8Pk83nY\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:40 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"3df8f6dfd6d63e45aa81ff5c06fc5f25","sha1":"e6f26e7f1ec9f58aec5a7f2f0db41533a76824cb","sha256":"b479c9a7c7a3be80c395ff6aba50c828f81f797917b6c905bee0c0675e42ef97","sha512":"e3503fbc71ee02b80efa934cf5078c77214e1be810a854687633d0923234c959a0340a766d2e476c4e232f0116645acf92e87408764fb6cdfcea9244aabfd25f","ssdeep":"","tlshash":"22d0951ab3141c164d404437d37ff7226b0055313ac01db5bd43b6572f458910c2c134","first_seen":"2026-08-27T22:31:18.027712Z","last_seen":"2026-08-27T22:31:18.027712Z","times_seen":1,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":178,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/gtm.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.830Z","timestamp":1787869839830,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/gtm.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEK5V081KVSZBT5\r\nx-amz-id-2: WL/LckAMZWXDF4UA6DPA/Kla35y5cwRRNKwEMeWKF3QI02/UIxSu4AfYqptj4sCTB51bs+COInWJ4zRCZUCISCRB6HN/RbAc\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"21423bd5900ad5ef3f2899e9caea633f","sha1":"720f2fdc5efbe9150ab169c708b9ae27a155b434","sha256":"ed774107b194d6ff92d136fe9789730fb6a729630df87d9cdc5cb4dcb392e3be","sha512":"840b49071cd407a0dd98a565e9b286efa5e60327eabecadc5a134dbdf55e822995b25230839a39123b2907a855381f00b7a6a43225ab5a4495042cf2a76e9cd4","ssdeep":"","tlshash":"90d02b23f714181166200d62b33be620bb5c853173c022f19589bac70b4b491492c320","first_seen":"2026-08-27T22:31:18.029668Z","last_seen":"2026-08-27T22:31:18.029668Z","times_seen":1,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":228,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"prod-cdn.wetransfer.net/packs/media/transfer_window/email-verification-lock-e6ed8c56.svg","fqdn":"prod-cdn.wetransfer.net","domain":"wetransfer.net","tld":"net"},"ip":{"addr":"13.249.8.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.840Z","timestamp":1787869839840,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 01 May 2026 00:00:00 GMT","end":"Sat, 14 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B5:D5:76:1F:6A:4F:27:15:F8:6D:9E:D2:3C:56:45:13:62:9E:50:A6","sha256":"1A:2C:4F:C2:BF:5A:82:13:B7:98:4D:13:0D:18:45:C4:5D:3A:C6:48:8E:03:08:F0:C7:0C:99:5F:97:86:4B:CE"}}},"request":{"raw":"GET /packs/media/transfer_window/email-verification-lock-e6ed8c56.svg HTTP/1.1\r\nHost: prod-cdn.wetransfer.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/svg+xml\r\ndate: Mon, 24 Aug 2026 06:41:40 GMT\r\nlast-modified: Thu, 21 Dec 2023 14:26:03 GMT\r\nserver: AmazonS3\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public, max-age=31536000\r\ncontent-encoding: gzip\r\netag: W/\"207f0c93fc997af575b8b9ad9db8777c\"\r\nvary: Accept-Encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 4cb92bb7ec58a91bffe664e66862dd94.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: TCoU9roMx2YeLTr6pwiSP0UeWZTOSj4NueFXg2nkmU4J5A4DOSMzWA==\r\nage: 316140\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1747,"size_decoded":1234,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"207f0c93fc997af575b8b9ad9db8777c","sha1":"9f7d95b4aacc2545baa6998d51041ec317fd4543","sha256":"03f8a16b83dee3c100530e0d94d6dd12833087841e1b7f5e56ca65c890984d92","sha512":"342281ab94285f9df2fc55af42ef780c046cbd70bffdad9b873f99ca6116515a8180cab79224c47d093e3643f0766429074b9164f482e6cb42d6ca88725de370","ssdeep":"","tlshash":"0e3142666339537ad424e32c8e3950b55b2395f0df1c302dd0a11833749a6cf9ed2af8","first_seen":"2023-05-15T21:49:42Z","last_seen":"2026-08-27T22:31:18.031563Z","times_seen":259,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":23,"dns":0,"connect":8,"send":0,"wait":10,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/gtm.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.353Z","timestamp":1787869840353,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/gtm.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEPF69E83DPB20F\r\nx-amz-id-2: cXxrVyvyTBsTmXGLWPuWGTU057vE4L6V+jfO16UccOZ79MtxJkvhIrUJ5yskF0CUag3KGchKgltDLUpBfO2E6gas8qjd0gT9\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"b0e193e2e280b73959aae94f9b230164","sha1":"9bdd817464bb81228ec503570677592b5df74740","sha256":"660ef865a5a893d435303c8cdfb57bdaf6f2e6063efa80afc566ff38c361552c","sha512":"06e992a0a3b625dbdabc9a3f956873089b6e4b10c7d9a0f50a5d9a38d2fb58300a0247988e7eb754e24ee58808cf0da44cdc2c8ba57decca597c64ddce4d53d0","ssdeep":"","tlshash":"9fd02b32b25854274a0015b2ab6bf726f704963116c4477949c658539b954c10e2c231","first_seen":"2026-08-27T22:31:18.032448Z","last_seen":"2026-08-27T22:31:18.032448Z","times_seen":1,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.693Z","timestamp":1787869840693,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1\r\nHost: maxcdn.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 27 Aug 2026 22:30:40 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"14d449eb8876fa55e1ef3c2cc52b0c17\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:04 GMT\r\ncdn-cachedat: 03/22/2025 12:19:15\r\ncdn-proxyver: 1.22\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1048\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: 485574128378151e16931dc418951974\r\ncdn-cache: HIT\r\nage: 823971\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a31e85a8597956c6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48944,"size_decoded":14462,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (48664)","md5":"14d449eb8876fa55e1ef3c2cc52b0c17","sha1":"a9545831803b1359cfeed47e3b4d6bae68e40e99","sha256":"e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b","sha512":"00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22","ssdeep":"768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B","tlshash":"7523c84a7254b4a202dfa476913f450bb73b389aa60bc16cb95994ed1d7cd8c3227f3c","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:25:03.344249Z","times_seen":111220,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.750Z","timestamp":1787869839750,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 27 Aug 2026 22:30:39 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"67176c242e1bdc20603c878dee836df3\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:06 GMT\r\ncdn-cachedat: 08/01/2025 15:36:25\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1078\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: a78b5a25cfaf2df533c60a6d4fa388d4\r\ncdn-cache: HIT\r\nage: 4119055\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a31e85a28daa2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":51039,"size_decoded":15426,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (50758)","md5":"67176c242e1bdc20603c878dee836df3","sha1":"27a71b00383d61ef3c489326b3564d698fc1227c","sha256":"56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4","sha512":"9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a","ssdeep":"768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+","tlshash":"3533b649725078b201df9176913f460bb736788ea907816cb95d98ed2e7cd89322bf3c","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:20:34.630514Z","times_seen":126584,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":3,"connect":10,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/en-0d65947306b8b68f172b.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.832Z","timestamp":1787869839832,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/en-0d65947306b8b68f172b.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEQT2TW71EDNP5V\r\nx-amz-id-2: q86jiZ56M3fQO1qhw6jjgLRlfa8rTSOLSzmkBxawBcC2qSfgbdEe0sC1R9NiSquxy7tZH51l4iRyhi6GnosjdYOV0xqCFgJO\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"1b3d55b7205c2560036c99807d4f2487","sha1":"9bfe4d4517d02192a812ff1e9d9f85d774051b53","sha256":"8706fe787521b329a0bb79a938b2fcb771b41be5d0c0ab2c942681f2738218c9","sha512":"b4f802f9ff09f98dbf485b32c2846b705091cd4666d1e1f82ea2fe19d40bdacc1c931a4ae15d82e38822023943a008131d1e555a05120dc5a4d37cada9ae74f9","ssdeep":"","tlshash":"33d02b127198d81429a00d723b6ab1217305db3071c4317d89cb66032f130900d68211","first_seen":"2026-08-27T22:31:18.040785Z","last_seen":"2026-08-27T22:31:18.040785Z","times_seen":1,"resource_available":false,"data":null}},"time_used":379,"timings":{"blocked":269,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/17116643.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.348Z","timestamp":1787869840348,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/17116643.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEVBZDMHFA7NSPQ\r\nx-amz-id-2: NwYIm51m7rUiBYpkL+lKge1U+9GjfiOt53jrXivXwGqslRwQsdNSscb+y3z7Y/OZLWKukgj48hcn1Avri67j4fiNf6Pymblj\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"2f6e796c304a9bba1b377f3bae5b4bef","sha1":"505969adde986b5c09b1a042b305cfdebb639f68","sha256":"4db2fbbbaaa66c61bf8c64dc46eea3079b5c3795a48e2e745dc2fb7d50bab8ec","sha512":"2265af04531d86a1e4f371b60a8aaf7f2e81d69d1b10f4a17faa1c3a5c65ea180ab788305bf65b86aa25ed18001fbb79c93d32c346d8bc3ab35a25fc6b6d70b6","ssdeep":"","tlshash":"48d095057709e4180b4116b1533fd521e754893012e435f95ae675c35f834c34c78750","first_seen":"2026-08-27T22:31:18.0431Z","last_seen":"2026-08-27T22:31:18.0431Z","times_seen":1,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mk2-b4c8d3.ingress-earth.ewp.live/packs/media/images/globe-dd3d31e7.svg","fqdn":"mk2-b4c8d3.ingress-earth.ewp.live","domain":"mk2-b4c8d3.ingress-earth.ewp.live","tld":"ingress-earth.ewp.live"},"ip":{"addr":"63.250.43.128","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.363Z","timestamp":1787869840363,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ingress-earth.ewp.live","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 23 May 2026 00:00:00 GMT","end":"Mon, 07 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D3:CA:61:41:32:BF:23:2E:18:7C:0B:22:6E:E5:E9:4C:8D:9D:07:A9","sha256":"6B:39:35:D2:5C:52:77:8B:BD:29:34:38:6A:FA:E7:26:FF:EA:2C:1B:C2:5B:41:F6:31:0C:CB:F0:2E:83:06:44"}}},"request":{"raw":"GET /packs/media/images/globe-dd3d31e7.svg HTTP/1.1\r\nHost: mk2-b4c8d3.ingress-earth.ewp.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-type: text/html\r\ndate: Thu, 27 Aug 2026 22:30:44 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-28T06:40:48.876544Z","times_seen":18143124,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/application-c2b6f877fed288c2431f.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.754Z","timestamp":1787869839754,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/application-c2b6f877fed288c2431f.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNERFSJTE3ZBANJA\r\nx-amz-id-2: OVdA5z7q/cCPsTrouftbAYPdOBGKHP1J1b4LJ9IVxFv63wGFFJKs17Nj3uom98Cmnu6sRQd13PmqZv2E0G/YOpqoiyIoctZs\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"5cec3b3ec6c41ac63bab433030530faf","sha1":"52d875e295397d32894c16213efa2d522640885d","sha256":"466f1b08e9578b9df7b057c281b8752e30ec2dccfd3373e3b11732fd19e2cdcc","sha512":"f39177e1cb32748fb49c064150bfbea3b68fdfe9b215064fff7755d4107bc14b9d08b56db6e7745ab889233944973665985d02b9928f4ffd7108669b0d17e714","ssdeep":"","tlshash":"26d09506fb0054255e520435b73be3216f14193231d105f0ddd771431f418924d3c170","first_seen":"2026-08-27T22:31:18.045876Z","last_seen":"2026-08-27T22:31:18.045876Z","times_seen":1,"resource_available":false,"data":null}},"time_used":312,"timings":{"blocked":-1,"dns":0,"connect":95,"send":0,"wait":114,"receive":0,"ssl":101},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/fbevents.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.804Z","timestamp":1787869839804,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/fbevents.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEZFDSC8KCVM0GS\r\nx-amz-id-2: 026ero7iCHRY9OvoCNXOYm5t3vMd+TSSKoHQ9l7Pc6GkxSL82RYFzjWOZOkk1qN4IbPtGCnEoBToeDKauwQ62k1hFhalY258\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"41311634f9dfb55d61b8ba41f24b0c1d","sha1":"f79ed1333f04500180ee73a9a5eca488e13a471d","sha256":"6ec2b8165add0575fbebd1b335a9fdf3f4524198840f2ba513e5d983a2b9df50","sha512":"bd75591069701b3be465a4f194ba1b3b6788f9abe3d86168a118774d42915f505f66a1d42720c07561cdb1106e72c6573f1d2aa7ab179f044e000b0da5ec76ed","ssdeep":"","tlshash":"ced09536b2851427e70009272f3ef510ab404534a2d022740fd075c75fd94d24e38331","first_seen":"2026-08-27T22:31:18.046868Z","last_seen":"2026-08-27T22:31:18.046868Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":143,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/17116643.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.812Z","timestamp":1787869839812,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/17116643.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEKSA3AXAC8HWSZ\r\nx-amz-id-2: 5fyhCf+bvH28gposzAg1Vee5DBWMEgXF0s9hyrNapIkdeJ4BDm1eoIUAjB/OvJ6u7hdFojRZQOCpjqL4LaVX3kdXIfiBw4eQ\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"f8c5c5006e807484600c7f41f26b39a0","sha1":"ca6904f430ac7a0305420f72d61cc42aec0c2b38","sha256":"1d3345ba37efd91e5f7102ea9c35f70a82504766069dba81690d0aeee577c6da","sha512":"47d62cd81c1adaff9cb981bc3f87e1c7c844fdd54a3597948b7ae781a058a400c790ff7afc2a884460106047bb779989f47a1ad5e476e212c20825a23a06c79a","ssdeep":"","tlshash":"dbd02b55b95438055d824c7a2a3aa229ff082931a5c826b8598252431b859d3191c626","first_seen":"2026-08-27T22:31:18.04826Z","last_seen":"2026-08-27T22:31:18.04826Z","times_seen":1,"resource_available":false,"data":null}},"time_used":343,"timings":{"blocked":237,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/en-de295c39cb769807d9fa.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.466Z","timestamp":1787869840466,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/en-de295c39cb769807d9fa.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEJVFBG5ASYJ6XZ\r\nx-amz-id-2: rVlWNjEOSC958zpEiSS5LuIQBNeS4DDv+UfDSPfXNLVQ+/Fdjr+IPDsVjHtHnS2ZReXMhJOr5NbBpGxMCW1vp/Y95Afa95Io\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"791202d7daa923978eacf04087af2d95","sha1":"f217a7a07100e272185d53faec2aaef8df8ce7b0","sha256":"abcdc37c3d3684f6068d69d06f0be47281eadcc6afbf89982d5927f78fa8d419","sha512":"8ef47b8ceec2bddba19c59e22ca50871984217371e7c250710b55be5665346fc3fed24110e8b810f543762eff5f1554622f4c50f65ce5c5d89bdb7332199bbd4","ssdeep":"","tlshash":"a5d09565f655545487010519bb3ff510e78c41323fc125b4cdcf5a9b4f454c55c69734","first_seen":"2026-08-27T22:31:18.049868Z","last_seen":"2026-08-27T22:31:18.049868Z","times_seen":1,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.589Z","timestamp":1787869840589,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 27 Aug 2026 22:30:40 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"67176c242e1bdc20603c878dee836df3\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:06 GMT\r\ncdn-cachedat: 08/01/2025 15:36:25\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1078\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: a78b5a25cfaf2df533c60a6d4fa388d4\r\ncdn-cache: HIT\r\nage: 4119056\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a31e85a7a89e2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":51039,"size_decoded":15426,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (50758)","md5":"67176c242e1bdc20603c878dee836df3","sha1":"27a71b00383d61ef3c489326b3564d698fc1227c","sha256":"56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4","sha512":"9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a","ssdeep":"768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+","tlshash":"3533b649725078b201df9176913f460bb736788ea907816cb95d98ed2e7cd89322bf3c","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:20:34.630514Z","times_seen":126584,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prod-cdn.wetransfer.net/packs/media/images/favicon-a34a7465.ico","fqdn":"prod-cdn.wetransfer.net","domain":"wetransfer.net","tld":"net"},"ip":{"addr":"13.249.8.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:41.179Z","timestamp":1787869841179,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 01 May 2026 00:00:00 GMT","end":"Sat, 14 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B5:D5:76:1F:6A:4F:27:15:F8:6D:9E:D2:3C:56:45:13:62:9E:50:A6","sha256":"1A:2C:4F:C2:BF:5A:82:13:B7:98:4D:13:0D:18:45:C4:5D:3A:C6:48:8E:03:08:F0:C7:0C:99:5F:97:86:4B:CE"}}},"request":{"raw":"GET /packs/media/images/favicon-a34a7465.ico HTTP/1.1\r\nHost: prod-cdn.wetransfer.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 41566\r\ndate: Mon, 13 Apr 2026 08:43:15 GMT\r\nlast-modified: Thu, 21 Dec 2023 14:25:56 GMT\r\netag: \"692e1c7339c359b6412f059c9c9a0474\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 4cb92bb7ec58a91bffe664e66862dd94.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: pGHJgsMxJdC5rskZl9htLRDr2Ct8t0cRbzBDmYevgI76Wl0UFNWBOw==\r\nage: 11800047\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":41566,"size_decoded":42119,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"692e1c7339c359b6412f059c9c9a0474","sha1":"e7c1a53dca16b7664880e5b8a92524cf9a47fb62","sha256":"d12161435ace47c6883360e08466508593325f134c1852b1d0e6e75d5f76adda","sha512":"115b958093186bf5f98beced2bde91775121083b1e73f720372d793a23ebc7cf130cc4c6196f5f0d725a809fd63997666ae1de36cf070dcb6b6d2178c6796894","ssdeep":"96:pnvhextGn8hK7mxOBsOqHJt46FWJisw0msSieZQckSpyt:pnZHKzxOeOqf46FWuASjQcA","tlshash":"0f13459726c4ca1cc7916f33c0e245fad77adc96cd34ae0fa18cbe5a7471529285b14c","first_seen":"2023-05-01T18:12:38Z","last_seen":"2026-08-27T22:31:18.05192Z","times_seen":2808,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/en-de295c39cb769807d9fa.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.833Z","timestamp":1787869839833,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/en-de295c39cb769807d9fa.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEZRT9NVT2F70FF\r\nx-amz-id-2: OhltUTlUTf/a8+zBs9QjS9buexjLmwPCyrjvK+k9ZfZ4Ut6+RZu3C3yZtlNziwMulhhIwwIFoPfYneQ40doj2nWbPYf0+8Wb\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:40 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"626d5336e196ad3067f91fe9ddb01717","sha1":"ac841f160d363a333a8b81bbee4669f9f61ad5ba","sha256":"427750830886cfea9aa03f59eded40c6b3548a0a5a0e495c791b198f5811b96d","sha512":"5ab133e2f275b59f389fc8fcf054709f6ba89e3e7a87b150adbb07947776ba32c29d58534f9bb6407363970e87be7cd200d31dd7fe8bf14c099638116aa1c410","ssdeep":"","tlshash":"f3d02b52b6209c150a410c26272eea306308553233c91975898255436f824915c2c221","first_seen":"2026-08-27T22:31:18.053586Z","last_seen":"2026-08-27T22:31:18.053586Z","times_seen":1,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":280,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/wallpaper-59e18dcf37d4cc5f163b.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.230Z","timestamp":1787869840230,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/wallpaper-59e18dcf37d4cc5f163b.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEYDYQ0BV8PMKGX\r\nx-amz-id-2: 0cYutBfrzGFp1tlmVwH9E1G4FWqrMA+ItxYYN/i8YdhfX5oI9xLnoVBGMj/5v6YG9TsMxRldX0eztcZOaXosWrxpEzkg3oyE\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"3cd519f8271c101d17aa2f915a10807c","sha1":"118684b9c09e8a9ed25f9ad56eec6fdbabe3a8a6","sha256":"5be7da5478034d4f318e0abdf536638c7835493700f6853a972eea48973629de","sha512":"db3175fe23b78af3d569a0840bf27728e9ab199f1b0c6419bfe1c579a4194b671224eca2734717f0e907cb6541b84079403552b9541121faf6136a37ce38c115","ssdeep":"","tlshash":"30d0755533065805d6600e567b3fff38bf9c803023c802700d806883bbc34918f14330","first_seen":"2026-08-27T22:31:18.05523Z","last_seen":"2026-08-27T22:31:18.05523Z","times_seen":1,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":114,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Bd-1bdd99f9.woff","fqdn":"mk2-b4c8d3.ingress-earth.ewp.live","domain":"mk2-b4c8d3.ingress-earth.ewp.live","tld":"ingress-earth.ewp.live"},"ip":{"addr":"63.250.43.128","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.379Z","timestamp":1787869840379,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ingress-earth.ewp.live","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 23 May 2026 00:00:00 GMT","end":"Mon, 07 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D3:CA:61:41:32:BF:23:2E:18:7C:0B:22:6E:E5:E9:4C:8D:9D:07:A9","sha256":"6B:39:35:D2:5C:52:77:8B:BD:29:34:38:6A:FA:E7:26:FF:EA:2C:1B:C2:5B:41:F6:31:0C:CB:F0:2E:83:06:44"}}},"request":{"raw":"GET /packs/media/actiefgrotesque/ActiefGrotesque_W_Bd-1bdd99f9.woff HTTP/1.1\r\nHost: mk2-b4c8d3.ingress-earth.ewp.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-type: text/html\r\ndate: Thu, 27 Aug 2026 22:30:44 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":13290,"size_decoded":13387,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5189)","md5":"8553bbcbb84d45213214887c96cadf69","sha1":"85f99f563a8188cf9bd3fd12e4cc53fcb693d8bf","sha256":"a3b1fbae97dc371670f87abde3b60cfaa0caf17c1878e7f08c123b66429f7fbc","sha512":"59a6abe016c89085cfdbf5f7a24904f1bba14b2090c774f1ae4557d297685a84c3b5e720025b30a0a3b5a47b06808ad602ca76fe99a98933dde33b734538632e","ssdeep":"192:xqkuICh/1y31t8uWuIPh/1y31t8uFOxarz2yAMGHimRyZY3JCsR+IcPzB4:cbIu41vIV417igz2yAfHGyJZR+DzW","tlshash":"9d529e7f1656446e1a9102bc4dd424090ded3487bae280d2f89d93ae1fea42075bb8bd","first_seen":"2025-05-28T12:06:52.097481Z","last_seen":"2026-08-27T22:31:18.057197Z","times_seen":63,"resource_available":false,"data":null}},"time_used":5701,"timings":{"blocked":-1,"dns":44,"connect":168,"send":0,"wait":1166,"receive":9,"ssl":4313},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/vendor-ef8fd9ca3a0295622111.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.071Z","timestamp":1787869840071,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/vendor-ef8fd9ca3a0295622111.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEMD7PE8CZVSMMQ\r\nx-amz-id-2: /6RbnzkiTIpp4QOlgqs3VVCp3trmZhtH76pki1/aNqjY/ybe/RPWJW38BzGwoIvZUnXbLlZTWIfwrNElMCnyyurOluNp/GZr\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:40 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"970ae534c1d3ca074d5d7f66d223a9a7","sha1":"83f785f0d6a5ca5f75ab6f0c0c43bfe296c202c6","sha256":"c192f0b8677561091e19379e40fc55ca7ded599c6b93ab8d816f692f87c74ad4","sha512":"cabf80b1c433558fc24ede4c7fea99c02230d26844df5aee9af79310fa2d3330d05ddab34cdb3cdb0e14af73f70d29a5951aa763a10c859f6a42127dc896494b","ssdeep":"","tlshash":"a8d02b5bb2596971b3114835a22ef133fb54843421d412b19a8225034f42c82ce28231","first_seen":"2026-08-27T22:31:18.057802Z","last_seen":"2026-08-27T22:31:18.057802Z","times_seen":1,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff","fqdn":"prod-cdn.wetransfer.net","domain":"wetransfer.net","tld":"net"},"ip":{"addr":"13.249.8.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.757Z","timestamp":1787869839757,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 01 May 2026 00:00:00 GMT","end":"Sat, 14 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B5:D5:76:1F:6A:4F:27:15:F8:6D:9E:D2:3C:56:45:13:62:9E:50:A6","sha256":"1A:2C:4F:C2:BF:5A:82:13:B7:98:4D:13:0D:18:45:C4:5D:3A:C6:48:8E:03:08:F0:C7:0C:99:5F:97:86:4B:CE"}}},"request":{"raw":"GET /packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff HTTP/1.1\r\nHost: prod-cdn.wetransfer.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 31120\r\ndate: Tue, 18 Aug 2026 18:54:28 GMT\r\nlast-modified: Thu, 21 Dec 2023 14:25:54 GMT\r\netag: \"57cbbfdafc43e0deecc75a309dd042c6\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 c683b079c7e660e9b6ed70f15b96641e.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: QLJJPxNQGUcLQzbSn2csrndgAE1SYVlMprDnBe2M6znaEh1EOZMbjw==\r\nage: 790573\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":31120,"size_decoded":31656,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 31120, version 1.6554","md5":"57cbbfdafc43e0deecc75a309dd042c6","sha1":"b9cc2ff331b8520706de175f5b3fdba6731a9bfc","sha256":"a9117f16bdaa64c953b303bef951dfca6316ef59f1b7ca72d5b946b1d815f6a6","sha512":"c997d44853dbc86c4a75e123306e504ab88ffdd7449b196ab200018adf355183a474ef71f31e61f949be3cb7bac888d3f3a22aec4226f9d50bd8b3fbde1ef13c","ssdeep":"768:P75Q02qtpsFozdYYk5SdY8cyynGiYENuQO9h:Nd2wq2zdYYktF5Nc","tlshash":"3dd2f1605f22c642d7baf9fef8e55ea488e147b4043cb26b0d5ed4ad9cd469901c306c","first_seen":"2023-04-30T22:39:51Z","last_seen":"2026-08-27T22:31:18.062921Z","times_seen":2141,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":12,"connect":8,"send":0,"wait":12,"receive":1,"ssl":235},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prod-cdn.wetransfer.net/packs/media/gt-super-wt/GT-Super-WT-Super-1b214df1.woff","fqdn":"prod-cdn.wetransfer.net","domain":"wetransfer.net","tld":"net"},"ip":{"addr":"13.249.8.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.760Z","timestamp":1787869839760,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 01 May 2026 00:00:00 GMT","end":"Sat, 14 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B5:D5:76:1F:6A:4F:27:15:F8:6D:9E:D2:3C:56:45:13:62:9E:50:A6","sha256":"1A:2C:4F:C2:BF:5A:82:13:B7:98:4D:13:0D:18:45:C4:5D:3A:C6:48:8E:03:08:F0:C7:0C:99:5F:97:86:4B:CE"}}},"request":{"raw":"GET /packs/media/gt-super-wt/GT-Super-WT-Super-1b214df1.woff HTTP/1.1\r\nHost: prod-cdn.wetransfer.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 43188\r\ndate: Tue, 18 Aug 2026 18:54:28 GMT\r\nlast-modified: Thu, 21 Dec 2023 14:25:55 GMT\r\netag: \"55576599a2d772f9297c5036d355b1fb\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 c683b079c7e660e9b6ed70f15b96641e.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: zk1qHbqNCXux5M6TuCo9rPuj9zZ0TJBZKGZBCEkMiG-3GkuuB4742w==\r\nage: 790572\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":43188,"size_decoded":43724,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 43188, version 0.0","md5":"55576599a2d772f9297c5036d355b1fb","sha1":"c52e4f9a59137105deb12a3de25ee7d5a15fd286","sha256":"1e3d5d86432b9bfcdf25ce0e35fd23667cea86f6fa71fa920cd84abb70258f73","sha512":"8270b97f43ffbe59405d81a988a5c194b15dcb3159d49ff7c37560c90069f1eef67bab8e15c2dcce69fb5cf51810d4d4834af69db6b6571bc3d0464c5d6b6514","ssdeep":"768:x94SBRGblSQhMXU2pewGKB6kuvBkW3fsNPSghXI+Ktehv2hMobEh5p:xhBcBoU2plBIBvODFy4hehMl5p","tlshash":"27130253c89b3f9c70b6b3bb55365ee128895c03e0666f1e3b41ec466f2b4d052e9351","first_seen":"2023-04-30T22:39:51Z","last_seen":"2026-08-27T22:31:18.064242Z","times_seen":2012,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":11,"connect":8,"send":0,"wait":11,"receive":8,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/bat.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.805Z","timestamp":1787869839805,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/bat.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JCYMW2HGXBN4FYFE\r\nx-amz-id-2: 80SgvPoA8OLxJf/dF7yUG79kP4LxkFrokaXUL8bsX5I0jZw5ZcE/gTluK1VJ6jT4w9ufc8pYuinuYUsui1EhBEuRX2W9lPQF\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"7133bdf288358e7d8807d5e2bf6d2f70","sha1":"22bfee4bd4288b04c01093703ee372e6870e23a1","sha256":"5ffaf7a8a6296ca33fd3fe06a35df61df5765b80a5eadab16a4b8def2ea14b42","sha512":"d13a924b0f9dc1bbac45d9b20403115f671bf6137f02294b91a6b9fc734ee9208b4a755d666c40a76038fc5cc2eed102df9a6b321eb6dad5f9b4d59d56b2265a","ssdeep":"","tlshash":"d9d09517b3603c194d858e75a17fe1317714493076c065b88b93f1d3cf5d4839e15931","first_seen":"2026-08-27T22:31:18.065573Z","last_seen":"2026-08-27T22:31:18.065573Z","times_seen":1,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":96,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.2.1.slim.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.1.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.834Z","timestamp":1787869839834,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-3.2.1.slim.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-10fdd\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Thu, 27 Aug 2026 22:30:39 GMT\r\nage: 2993540\r\nx-served-by: cache-lga21984-LGA, cache-bma-essb1270064-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 228649, 11156\r\nx-timer: S1787869840.868725,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 23856\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":69597,"size_decoded":24498,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32012)","md5":"5f48fc77cac90c4778fa24ec9c57f37d","sha1":"9e89d1515bc4c371b86f4cb1002fd8e377c1829f","sha256":"9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398","sha512":"cab8c4afa1d8e3a8b7856ee29ae92566d44ceead70c8d533f2c98a976d77d0e1d314719b5c6a473789d8c6b21ebb4b89a6b0ec2e1c9c618fb1437ebc77d3a269","ssdeep":"1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT","tlshash":"b663d5d9b2c67062db7730b950bf410bf07a98dab44c8c60e198d8d47d78a99817bf2d","first_seen":"2023-03-07T01:02:43Z","last_seen":"2026-08-28T05:20:34.614307Z","times_seen":81302,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":3,"connect":9,"send":0,"wait":9,"receive":3,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.715Z","timestamp":1787869840715,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30028\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 26 Aug 2026 10:31:12 GMT\r\nexpires: Thu, 26 Aug 2027 10:31:12 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 129568\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85578,"size_decoded":30992,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32065)","md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-28T05:24:49.157381Z","times_seen":295475,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":17,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-27T22:30:38.882Z","timestamp":1787869838882,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 7gLo1sDjfP5IA5/LWJWkXqs8RMLvOrNrR/4lBh1v87E/0KY/TPRTxif8AnQkcxrSJv/WRTNHyvmmTLQLIT8PDZTcY2U342lO\r\nx-amz-request-id: JCYGYE9XW5WK9ZXW\r\nDate: Thu, 27 Aug 2026 22:30:40 GMT\r\nLast-Modified: Tue, 25 Aug 2026 14:59:56 GMT\r\nETag: \"7592aa26de530f91dd35b975f4d95968\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: text/html\r\nContent-Length: 613877\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"Snowplow Analytics","description":"Snowplow is an open-source behavioral data management platform for businesses.","website":"https://snowplowanalytics.com","common_platform_enumeration":"","icon":"Snowplow.svg","categories":["Analytics","IaaS"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Popper:1.12.9","description":"Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.","website":"https://popper.js.org","common_platform_enumeration":"","icon":"Popper.svg","categories":["Miscellaneous"]},{"name":"Bootstrap:4.1.3","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"BootstrapCDN:4.1.3","description":"BootstrapCDN is a powerful and reliable Content Delivery Network (CDN) that delivers static resources, including CSS, JavaScript, and font files, for the widely-used Bootstrap framework. By leveraging multiple server locations worldwide, BootstrapCDN accelerates website loading times, ensuring a smooth and visually appealing user experience. Additionally, it ensures website compatibility with various devices and browsers. The service reduces bandwidth usage and server load, improving web performance for developers and end-users alike.","website":"https://www.bootstrapcdn.com/","common_platform_enumeration":"","icon":"BootstrapCDN.png","categories":["CDN"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}],"data":{"size":613877,"size_decoded":614294,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (62958), with CRLF line terminators","md5":"94053f0d87c560f84510d8eddca807d1","sha1":"5eb2f904f781f2c6a559f0e56771d683da6a1fc4","sha256":"4b83ed8d146f0c50128279a717188ed953874e6b0b2e4de981380a72c259d5a0","sha512":"8be748701c02d7a492bb543e3d4e53b5d93b7112752d2b359ab060f79e41b4eb2a0c336e6015c4956152f203701136ca6813167b60997493f5a6a34cdf461fa2","ssdeep":"12288:PkTBMXjRSZEq1juWQO1iJD5WvpPWCovouf:PC9ZEqBuWQO1iJD5WvU","tlshash":"0ad45b36a6691914db7bcab6b5c1fe943c24ed13c143c4d8f28573ac8ac722547f2b1a","first_seen":"2026-08-26T23:06:13.260993Z","last_seen":"2026-08-27T22:31:18.072011Z","times_seen":3,"resource_available":false,"data":null}},"time_used":899,"timings":{"blocked":-1,"dns":3,"connect":96,"send":0,"wait":121,"receive":480,"ssl":199},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js","fqdn":"maxcdn.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.836Z","timestamp":1787869839836,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1\r\nHost: maxcdn.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 27 Aug 2026 22:30:39 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"14d449eb8876fa55e1ef3c2cc52b0c17\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:04 GMT\r\ncdn-cachedat: 03/22/2025 12:19:15\r\ncdn-proxyver: 1.22\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1048\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: 485574128378151e16931dc418951974\r\ncdn-cache: HIT\r\nage: 823970\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a31e85a30d0b56c6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48944,"size_decoded":14462,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (48664)","md5":"14d449eb8876fa55e1ef3c2cc52b0c17","sha1":"a9545831803b1359cfeed47e3b4d6bae68e40e99","sha256":"e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b","sha512":"00d9069b9bd29ad0daa0503f341d67549cce28e888e1affd1a2a45b64a4c1bc460d81cfc4751857f991f2f4fb3d2572fd97fca651ba0c2b0255530209b182f22","ssdeep":"768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B","tlshash":"7523c84a7254b4a202dfa476913f450bb73b389aa60bc16cb95994ed1d7cd8c3227f3c","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:25:03.344249Z","times_seen":111220,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":3,"connect":11,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.838Z","timestamp":1787869839838,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30028\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 26 Aug 2026 10:31:12 GMT\r\nexpires: Thu, 26 Aug 2027 10:31:12 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 129567\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85578,"size_decoded":31012,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32065)","md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-28T05:24:49.157381Z","times_seen":295475,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":1,"connect":14,"send":0,"wait":20,"receive":15,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/0.txt","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.841Z","timestamp":1787869839841,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/0.txt HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEM5F6H60290107\r\nx-amz-id-2: ZUiEhQMcviGIQ3jwtDxUWBhwPlnc7mszsqrZ0P9dcSwYIdNhepPLiP6uddUpJuztLthxL22ASnpMPcn8tqYPk8oRzSMJeXRg\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"7a40dbe6d60b4a7773e424917ecc85fe","sha1":"1ee20c2afe45cae8604756d3afffe32f9b5ceec5","sha256":"02dd9470230a6bf695018b71086a01bc8fc9301c87a574185b08ea37b20b203b","sha512":"debb37a059448fa7d3e2e269f3babae0379f3522531951bca50190c8663eb82315b1991648fd0b33b97c0be795c3b94f48308a9d24d1e5dfb7c39b618ce8a4c3","ssdeep":"","tlshash":"6fd02b1af25664196a910662577be521db18933122e9b37589a469d70fd24c2497c120","first_seen":"2026-08-27T22:31:18.073678Z","last_seen":"2026-08-27T22:31:18.073678Z","times_seen":1,"resource_available":false,"data":null}},"time_used":435,"timings":{"blocked":327,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff","fqdn":"mk2-b4c8d3.ingress-earth.ewp.live","domain":"mk2-b4c8d3.ingress-earth.ewp.live","tld":"ingress-earth.ewp.live"},"ip":{"addr":"63.250.43.128","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.380Z","timestamp":1787869840380,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ingress-earth.ewp.live","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 23 May 2026 00:00:00 GMT","end":"Mon, 07 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D3:CA:61:41:32:BF:23:2E:18:7C:0B:22:6E:E5:E9:4C:8D:9D:07:A9","sha256":"6B:39:35:D2:5C:52:77:8B:BD:29:34:38:6A:FA:E7:26:FF:EA:2C:1B:C2:5B:41:F6:31:0C:CB:F0:2E:83:06:44"}}},"request":{"raw":"GET /packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff HTTP/1.1\r\nHost: mk2-b4c8d3.ingress-earth.ewp.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-type: text/html\r\ndate: Thu, 27 Aug 2026 22:30:44 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":13290,"size_decoded":13387,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5189)","md5":"8553bbcbb84d45213214887c96cadf69","sha1":"85f99f563a8188cf9bd3fd12e4cc53fcb693d8bf","sha256":"a3b1fbae97dc371670f87abde3b60cfaa0caf17c1878e7f08c123b66429f7fbc","sha512":"59a6abe016c89085cfdbf5f7a24904f1bba14b2090c774f1ae4557d297685a84c3b5e720025b30a0a3b5a47b06808ad602ca76fe99a98933dde33b734538632e","ssdeep":"192:xqkuICh/1y31t8uWuIPh/1y31t8uFOxarz2yAMGHimRyZY3JCsR+IcPzB4:cbIu41vIV417igz2yAfHGyJZR+DzW","tlshash":"9d529e7f1656446e1a9102bc4dd424090ded3487bae280d2f89d93ae1fea42075bb8bd","first_seen":"2025-05-28T12:06:52.097481Z","last_seen":"2026-08-27T22:31:18.057197Z","times_seen":63,"resource_available":false,"data":null}},"time_used":4721,"timings":{"blocked":-1,"dns":44,"connect":160,"send":0,"wait":325,"receive":10,"ssl":4182},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff","fqdn":"mk2-b4c8d3.ingress-earth.ewp.live","domain":"mk2-b4c8d3.ingress-earth.ewp.live","tld":"ingress-earth.ewp.live"},"ip":{"addr":"63.250.43.128","port":443,"asn":22612,"as":"NAMECHEAP-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.381Z","timestamp":1787869840381,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ingress-earth.ewp.live","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sat, 23 May 2026 00:00:00 GMT","end":"Mon, 07 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D3:CA:61:41:32:BF:23:2E:18:7C:0B:22:6E:E5:E9:4C:8D:9D:07:A9","sha256":"6B:39:35:D2:5C:52:77:8B:BD:29:34:38:6A:FA:E7:26:FF:EA:2C:1B:C2:5B:41:F6:31:0C:CB:F0:2E:83:06:44"}}},"request":{"raw":"GET /packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff HTTP/1.1\r\nHost: mk2-b4c8d3.ingress-earth.ewp.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncontent-type: text/html\r\ndate: Thu, 27 Aug 2026 22:30:44 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":33946,"size_decoded":34043,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (25845)","md5":"57881c4b14c33c593900877fa767bec7","sha1":"2c607192f86a38682a6833c1fc135ef8b53f06a3","sha256":"7c7169f521680ebd2ba89f19cd4791c5891dd71a164be2771a52b07fa0053624","sha512":"62bb903a6dab344ae9d459902c299b24a9d103c5d19360bd2d4ea5b223f32cc1c1925abc3f4a642347ebcc7ffaae881bbd517d716f7d5c6bacae1d74fd5a08b9","ssdeep":"768:EIu4IVKSyAfHPAzB1HYTsJxCcHzRHDODW6wf:EIBI4SPP8HrbvHlDOS6a","tlshash":"a4e2e17e5a9a892d0d11437c8747aa084dbd209b39e2d951fe5b237c0ee105425fbc7e","first_seen":"2026-08-27T22:31:18.07589Z","last_seen":"2026-08-27T22:31:18.07589Z","times_seen":1,"resource_available":false,"data":null}},"time_used":5544,"timings":{"blocked":-1,"dns":42,"connect":165,"send":0,"wait":1027,"receive":2,"ssl":4307},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-27","alert":"Sinkholed","trigger":"mk2-b4c8d3.ingress-earth.ewp.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.637Z","timestamp":1787869840637,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 27 Aug 2026 22:30:40 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 6157\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:15:37 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6mc%2BBp1iSjwry9Rk2NBTYCQtUd0MSFWoazDjSZChCM4rIR%2FhQJgPJTjRQnAi2pkMaNRmPstUrIZslDwOHTO8aglAgfO2eSZ33twq%2B8cD8NI1lznkO6q0tz5WN4nv%2FKJYVX9nI1js\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a31e85a7fbcb5690-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19188,"size_decoded":7163,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (19015)","md5":"70d3fda195602fe8b75e0097eed74dde","sha1":"c3b977aa4b8dfb69d651e07015031d385ded964b","sha256":"a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66","sha512":"51affb5a8cfd2f93b473007f6987b19a0a1a0fb970ddd59ef45bd77a355d82abbbd60468837a09823496411e797f05b1f962ae93c725ed4c00d514ba40269d14","ssdeep":"384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f","tlshash":"1c82a3cc3291b06643a79167a06f960fb2339979614e9410f199f2d87c70ef9913fc7a","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:20:34.61732Z","times_seen":111599,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/runtimeapplication-bafdd8b86fd88bb4273d.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.752Z","timestamp":1787869839752,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/runtimeapplication-bafdd8b86fd88bb4273d.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNESBAVBEMKWSSN7\r\nx-amz-id-2: URGTDb2ztx1BchNdjEbUh1iMmJ+3W82FJ4t5WKOwCUAY3Zg5QGAf66cDLwdk7OV5FDEerjlGLCO3DckhEVdSt/h5M1U+dq3r\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"f2c9f603d64d9f262e0e535378b8f1d1","sha1":"7f575f6ed4ed1c052bc55f31ce8c761c5b2c1f5e","sha256":"bd8a5ec4605b220856388dbfaf08e5811e5bfec929da570b442461ad20c43ea1","sha512":"a5e82c70f1898bb019f33259e671fa297c357a220950a89a2bf611ac9ac4a74222307d256ceefc160929d36095adbca1104dc295d0d7e01dc0ef8b99ddfeee7d","ssdeep":"","tlshash":"ccd02b27b104680d068a993d6a7fe531b7085d3566d426f41f5161935f429800918268","first_seen":"2026-08-27T22:31:18.079922Z","last_seen":"2026-08-27T22:31:18.079922Z","times_seen":1,"resource_available":false,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":1,"connect":96,"send":0,"wait":111,"receive":0,"ssl":100},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.835Z","timestamp":1787869839835,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 27 Aug 2026 22:30:39 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 6157\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:15:37 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=h8F8Uq0e%2FTFJPZ1o9xQbK6yZbYa0TwptSOWhQA2145fH4%2FWGbb5w8TgtQPHfQXpUd72vKvJxJTcUP1JuAVUQYKA%2F2zQBST5uAmkp5PVLboFw7CggeLPtlO3uEjG3B9CHAenWqIye\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a31e85a308c75690-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19188,"size_decoded":7161,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (19015)","md5":"70d3fda195602fe8b75e0097eed74dde","sha1":"c3b977aa4b8dfb69d651e07015031d385ded964b","sha256":"a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66","sha512":"51affb5a8cfd2f93b473007f6987b19a0a1a0fb970ddd59ef45bd77a355d82abbbd60468837a09823496411e797f05b1f962ae93c725ed4c00d514ba40269d14","ssdeep":"384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f","tlshash":"1c82a3cc3291b06643a79167a06f960fb2339979614e9410f199f2d87c70ef9913fc7a","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:20:34.61732Z","times_seen":111599,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":2,"connect":12,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/en-0d65947306b8b68f172b.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.356Z","timestamp":1787869840356,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/en-0d65947306b8b68f172b.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEMXPXFA5ZXKEMQ\r\nx-amz-id-2: yf4xA2+YcrixYDppCdnI4U2NLbvjqcygxR4TnHv7PlDZLuo0ds+YCbzUXj08URBXrUbyU/eGzycqvoX+UFDiEVOaRf9wd0nZ\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:40 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"291502744b3346135aa69246c81572ba","sha1":"432802b37b959002b895b5410f40d11eaec35ae7","sha256":"a1b33d0643cf8d47ca2603de230beebe6d3db2753cde77e331ea7cd2b06649fe","sha512":"05baf72dc3acd329862f4a4d9f45683ee1814436356afd40945b62bf07642f2646673923721f1262d1282d7030263cd956e638c51d49fb61c746649157e3ca74","ssdeep":"","tlshash":"18d02b3ab315681607510a2d597bf8156b00073117e024ba5a6539830b414818d54930","first_seen":"2026-08-27T22:31:18.081724Z","last_seen":"2026-08-27T22:31:18.081724Z","times_seen":1,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/0.txt","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.573Z","timestamp":1787869840573,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/0.txt HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNEHNZEH0PX353JJ\r\nx-amz-id-2: 5cOAUGc1wcqyYG8cqp39q+5dAOAeLD5P3fNWg3Gz6oAmhQMsWdgd6erEZkzCSjwQhWtrxChpmRsC7agXCHJovXfYARvUmaRa\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:40 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"0c0ebd3dffaf05b0bfc91dc5c9693c32","sha1":"c5cf25482a73f4665d5aaa36112b1d0fcd969356","sha256":"ac006a5734598ffc7fe62d35a6c898fb15d74bc03f398ea4dc5fdb3fdba4e7a0","sha512":"d3c91d4a20210bf09fba025c448223996f1316b9c25af2ca27a4564d9ea5d6c49989f5b00591adbe15f9b4b3a47fb51c92863b5b928652556008f9d33b4d1757","ssdeep":"","tlshash":"cbd095727304d8055a414e1df73bf335f755143823d40b79e9c1a54b0f854c54c2c220","first_seen":"2026-08-27T22:31:18.083094Z","last_seen":"2026-08-27T22:31:18.083094Z","times_seen":1,"resource_available":false,"data":null}},"time_used":104,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.2.1.slim.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.1.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.609Z","timestamp":1787869840609,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-3.2.1.slim.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-10fdd\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Thu, 27 Aug 2026 22:30:40 GMT\r\nage: 2993541\r\nx-served-by: cache-lga21984-LGA, cache-bma-essb1270064-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 228649, 11157\r\nx-timer: S1787869841.611765,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 23856\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":69597,"size_decoded":24498,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32012)","md5":"5f48fc77cac90c4778fa24ec9c57f37d","sha1":"9e89d1515bc4c371b86f4cb1002fd8e377c1829f","sha256":"9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398","sha512":"cab8c4afa1d8e3a8b7856ee29ae92566d44ceead70c8d533f2c98a976d77d0e1d314719b5c6a473789d8c6b21ebb4b89a6b0ec2e1c9c618fb1437ebc77d3a269","ssdeep":"1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT","tlshash":"b663d5d9b2c67062db7730b950bf410bf07a98dab44c8c60e198d8d47d78a99817bf2d","first_seen":"2023-03-07T01:02:43Z","last_seen":"2026-08-28T05:20:34.614307Z","times_seen":81302,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.10.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.757Z","timestamp":1787869840757,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 01 Jul 2026 06:33:56 GMT","end":"Tue, 29 Sep 2026 07:33:46 GMT"},"fingerprint":{"sha1":"95:C5:B1:CC:FD:2D:A2:1D:9E:F8:29:11:70:8F:C2:32:DB:0A:16:D8","sha256":"67:23:C0:55:AC:EE:9D:BF:1F:32:F6:C6:31:3A:5A:3F:85:B5:50:88:71:96:38:D1:BB:37:21:B0:0C:CF:B9:EA"}}},"request":{"raw":"GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 27 Aug 2026 22:30:40 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncdn-pullzone: 252412\r\ncdn-requestcountrycode: DE\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"67176c242e1bdc20603c878dee836df3\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:06 GMT\r\ncdn-cachedat: 08/01/2025 15:36:25\r\ncdn-proxyver: 1.33\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 1078\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: a78b5a25cfaf2df533c60a6d4fa388d4\r\ncdn-cache: HIT\r\nage: 4119056\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncf-ray: a31e85a8baec2efa-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":51039,"size_decoded":15426,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (50758)","md5":"67176c242e1bdc20603c878dee836df3","sha1":"27a71b00383d61ef3c489326b3564d698fc1227c","sha256":"56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4","sha512":"9fa75814e1b9f7db38fe61a503a13e60b82d83db8f4ce30351bd08a6b48c0d854baf472d891af23c443c8293380c2325c7b3361b708af9971aa0ea09a25cdd0a","ssdeep":"768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+","tlshash":"3533b649725078b201df9176913f460bb736788ea907816cb95d98ed2e7cd89322bf3c","first_seen":"2023-03-07T01:02:44Z","last_seen":"2026-08-28T05:20:34.630514Z","times_seen":126584,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff","fqdn":"prod-cdn.wetransfer.net","domain":"wetransfer.net","tld":"net"},"ip":{"addr":"13.249.8.90","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.759Z","timestamp":1787869839759,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 01 May 2026 00:00:00 GMT","end":"Sat, 14 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"B5:D5:76:1F:6A:4F:27:15:F8:6D:9E:D2:3C:56:45:13:62:9E:50:A6","sha256":"1A:2C:4F:C2:BF:5A:82:13:B7:98:4D:13:0D:18:45:C4:5D:3A:C6:48:8E:03:08:F0:C7:0C:99:5F:97:86:4B:CE"}}},"request":{"raw":"GET /packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff HTTP/1.1\r\nHost: prod-cdn.wetransfer.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nOrigin: https://s3.us-east-1.amazonaws.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: font/woff\r\ncontent-length: 32124\r\ndate: Tue, 18 Aug 2026 18:54:28 GMT\r\nlast-modified: Thu, 21 Dec 2023 14:25:54 GMT\r\netag: \"868aedeefe7669e8a4f7196f7df5d058\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 c683b079c7e660e9b6ed70f15b96641e.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: hbgfOt-uXkOhqp7xnnx5nqkNa86NT4iHsgp7x1EnNcyPrrs-FJCEQA==\r\nage: 790573\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":32124,"size_decoded":32660,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 32124, version 1.6554","md5":"868aedeefe7669e8a4f7196f7df5d058","sha1":"45bd20ef2c6b717a2526efd98a01207979b2a623","sha256":"d8700b022ef56752cd12ff224b3f409e84aeb8a43ac68ba052167096baf46555","sha512":"45557b3f328f014fcbf09a848b2f22e66c41968b03523976f66f9381b0408461766f1b837caaa67a26c4b707ea81ef32cf59776244d19bf0d569c63753b5c0b6","ssdeep":"384:9KqyAC8A/DfD+jM4dELqNANmz6tHTp9cQkHusYuItzXpWiwhXG+l9dmUbggofHJ5:9JY8A/74miY9uQATzi8t9dmMgdU8p7j","tlshash":"58e2f1b36a6673d5e06c3b7787afb6607c9f4ef8e4ac407847e2cdd80659242d422463","first_seen":"2023-04-30T22:39:51Z","last_seen":"2026-08-27T22:31:18.084435Z","times_seen":2142,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":12,"connect":9,"send":0,"wait":11,"receive":1,"ssl":233},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/wallpaper-59e18dcf37d4cc5f163b.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.810Z","timestamp":1787869839810,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/wallpaper-59e18dcf37d4cc5f163b.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNER780R5JEC1041\r\nx-amz-id-2: b/9tIWAHATA4ueVUn7p/VPojN+VSF1y63L5v8NIkYUBIm6ZoL2wNGqZSzizRRngO4K/Xk9TOPyL0+v+k2m8MhHuNmrwIWVXT\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"461ae185f85eff098b88a9f40c68961c","sha1":"ae888965fe69b63dca714a85de373cca5aad6712","sha256":"50b1936fba63f518eaa6265c42b01f9666daff984ef9110c3fbf86ebb25aca4a","sha512":"2a5da20a399e0ca6b427a2acecbd9e394b3e73a9fa1bf5fae0271199219edc15593293b2e6d8faccd4478c2add13b99b6e25ad6591a63d1fbc1d04ef017411ec","ssdeep":"","tlshash":"24d09513725434641f121a26653fe131a744963035c525799bc375c70f814824f14738","first_seen":"2026-08-27T22:31:18.085381Z","last_seen":"2026-08-27T22:31:18.085381Z","times_seen":1,"resource_available":false,"data":null}},"time_used":276,"timings":{"blocked":170,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/sp.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.831Z","timestamp":1787869839831,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/sp.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNERCK0HRBFSPEFZ\r\nx-amz-id-2: t3FfiTX33Ltac2NyEVVOfyfkXtTDQNo1WZs3ZDvagM7FnwUXGg3n797CPEP3YIBQmocPaD5U0jSFV1V4ZvDEAcUYIYfLbOE3\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"a5d75fd97b10809c4ffbd4308561cb45","sha1":"ce2b76a702f99a87c5c8d23f1a4717a70728e6eb","sha256":"a3f07ee169f306286888a0dbaee09a9618aa0738d73a4c915e8b4bc9d9f15d53","sha512":"d188593621cd3e441d81f9a7cd749b7933f8841885b20e386cbff5dd1a8260fde3c843917d6bb4b7ce8fde517c96379ad0e8fd6f976aa64285e730421ce454bd","ssdeep":"","tlshash":"5bd09522f330a5141a100616972ede30e754573423c821f4a54195830f41c930d38134","first_seen":"2026-08-27T22:31:18.087859Z","last_seen":"2026-08-27T22:31:18.087859Z","times_seen":1,"resource_available":false,"data":null}},"time_used":366,"timings":{"blocked":263,"dns":0,"connect":0,"send":0,"wait":103,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/sp.js","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:40.355Z","timestamp":1787869840355,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/sp.js HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://s3.us-east-1.amazonaws.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JNESQMD031K92DYK\r\nx-amz-id-2: ayV/gb/2ygkuv3I1tzRD6g1fqMIfk6ec6bMG/wa4X+9vGp4ehcqP17MFV1dAV+LuBNe/3a8uvmLiCqubVxiv1vXbCrcrI78M\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"c029fd363545840614d1c54129b3b8bf","sha1":"e9cd71819d2d89cf670fdf539e65dd471c51ffe6","sha256":"9786e2c48df440f39d66ca2f410be79df65098284c1a727e347fc926c0eb6106","sha512":"a5cf2f64607be69b4e52a53d282213b3946814cd8e440f54c6e23ff2f954cd7a32125475146fa6a2531b67b6ce4622ea8d79ef13abb8bb69038437b0b571f608","ssdeep":"","tlshash":"cbd02b597204141d0d804965672efd64b7044632b2c422b5b99590432b924810cfc331","first_seen":"2026-08-27T22:31:18.0892Z","last_seen":"2026-08-27T22:31:18.0892Z","times_seen":1,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/css/vendor-ef8fd9ca3a0295622111.html","fqdn":"s3.us-east-1.amazonaws.com","domain":"s3.us-east-1.amazonaws.com","tld":""},"ip":{"addr":"16.15.252.66","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html","date":"2026-08-27T22:30:39.756Z","timestamp":1787869839756,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s3.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 18 Nov 2025 00:00:00 GMT","end":"Fri, 06 Nov 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D4:87:03:14:FE:12:27:46:E3:63:CC:7B:43:A1:D0:D8:B9:17:AF:7D","sha256":"7E:BF:42:63:5D:C3:2B:CB:97:F6:0E:38:3E:E1:F8:63:39:AA:CE:A2:39:E1:56:B9:8D:74:1C:79:12:67:14:36"}}},"request":{"raw":"GET /ejima09-2.amazonaws.vanish-obi-regre/css/vendor-ef8fd9ca3a0295622111.html HTTP/1.1\r\nHost: s3.us-east-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://s3.us-east-1.amazonaws.com/ejima09-2.amazonaws.vanish-obi-regre/Aws+wetransfer+index.html\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nx-amz-request-id: JCYWQG2W02FQ6WJN\r\nx-amz-id-2: LPiQk6w4vaps/DA+iKoTrU4Z6rVCBQPCehJon7bBzoXKXC+qQKsnliuUuZ2YN4uLuop5AK0CIGq7sgnBOGcmV9DMzSCPQqle\r\nContent-Type: application/xml\r\nTransfer-Encoding: chunked\r\nDate: Thu, 27 Aug 2026 22:30:39 GMT\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":263,"size_decoded":549,"mime_type":"application/xml","magic":"XML 1.0 document, ASCII text","md5":"773303425bd38620c49066e0df1bcaa0","sha1":"b1f9fc61af9eaf44c8e2fe125db9db3c3b33cc0a","sha256":"4bf3aadf4af6bcd8af8f4e29b80540bb7c57e63d2b18ace89e265015b3ca8fd4","sha512":"ccfdfd9df1c7e0533a6ce028e7f8a53ee6166e0341ace78bfdd2ef1ab5fd53c789ac1d3c5d87b890333ab606d34051b22f4825c5afcf6adef9da7843fd3378b9","ssdeep":"","tlshash":"49d02b32b28898166b40151ab63fd331a710c53413c026b5499a59435b879a74e28735","first_seen":"2026-08-27T22:31:18.090685Z","last_seen":"2026-08-27T22:31:18.090685Z","times_seen":1,"resource_available":false,"data":null}},"time_used":132,"timings":{"blocked":-1,"dns":0,"connect":97,"send":0,"wait":104,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Known Phishing Kit detected","verdict":"phishing","severity":"high","comment":"","tags":["phishing"],"meta":null}]}}]}