{"report_id":"58ab1310-346c-4cd4-8818-66f34aa84d87","version":0,"status":"done","tags":["docusign","phishing","suspicious"],"date":"2026-06-10T01:16:32Z","url":{"schema":"http","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"title":"DocuSign Login - Enter your password to sign in","dom":{"size":256346,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65353)","md5":"cb31a9b24675ea06b6a8e8c93df86773","sha1":"bca463d2781b3409b80b7210d07962213757778f","sha256":"92ad58f6039cff78dda23382f9c894e9bdd8ceefdfbd35306126b649cefc11ab","sha512":"e0568fe003898b2a6b9b2c76e691adad263a115b97fec08df946c0ba7413d3584f1744e93fef9e803b5f8d78ea3a5727b099cbe1e74ae072fc3ff069999aad2d","ssdeep":"6144:gajpSYt72uB8zd3nuatHiuZ1aYxs7TA7VmsebIxzFJkzFuOtbXf5n:ga1SYtRc33CMaoQTA7Vmsebr","tlshash":"5a448a3249239c2708ded5c7591d6fda7fa4cdcb46316223b07c818ca791af22d9a25f","dom_hash":"domhash3b1c083b9c6b990d991ac0782a44ebbd","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-15T01:16:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":4,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-10","alert":"Detects file containing Telegram Bot API","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-10","alert":"Phishing Block","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DocuSign","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with DocuSign phishing","tags":["docusign","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-06-08T07:31:13.685477Z","alert_count":0,"request_count":1,"received_data":86562,"sent_data":451,"comment":"","tags":null,"fingerprints":null},{"fqdn":"blog.cpanel.com","ip":{"addr":"104.26.4.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2000-03-03","domain_rank":0,"first_seen":"2015-03-28T15:17:30Z","last_seen":"2026-05-26T01:01:02.198296Z","alert_count":0,"request_count":1,"received_data":625,"sent_data":536,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.fusionsol.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2005-06-04","domain_rank":0,"first_seen":"2015-03-04T09:07:50Z","last_seen":"2025-08-07T13:12:58.043736Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":554,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.pixabay.com","ip":{"addr":"104.18.40.96","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2010-10-07","domain_rank":298908,"first_seen":"2017-01-29T11:20:46Z","last_seen":"2026-06-06T10:36:26.396858Z","alert_count":0,"request_count":1,"received_data":165518,"sent_data":541,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.freelogovectors.net","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2010-09-13","domain_rank":2945782,"first_seen":"2018-09-23T13:53:54Z","last_seen":"2026-05-22T10:52:09.251033Z","alert_count":0,"request_count":1,"received_data":5011,"sent_data":545,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-08-23","domain_rank":0,"first_seen":"2024-02-23T13:11:02Z","last_seen":"2026-06-08T17:18:33.042233Z","alert_count":8,"request_count":1,"received_data":256412,"sent_data":521,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:2.2.4","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}]},{"fqdn":"partner.zoom.us","ip":{"addr":"141.193.213.21","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"United States","country_code":"US"},"domain_registered":"2002-04-24","domain_rank":4980619,"first_seen":"2022-06-02T19:29:54Z","last_seen":"2026-05-26T01:01:02.303221Z","alert_count":0,"request_count":1,"received_data":606,"sent_data":546,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"partner.zoom.com","ip":{"addr":"170.114.78.89","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"United States","country_code":"US"},"domain_registered":"1999-04-22","domain_rank":0,"first_seen":"2025-06-25T19:20:20.421058Z","last_seen":"2026-05-26T01:01:02.414105Z","alert_count":0,"request_count":1,"received_data":4324,"sent_data":515,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"www.cpanel.net","ip":{"addr":"104.18.35.25","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2000-11-12","domain_rank":965917,"first_seen":"2012-05-21T17:59:56Z","last_seen":"2026-06-04T09:09:31.545557Z","alert_count":0,"request_count":2,"received_data":1268,"sent_data":1147,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DocuSign","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with DocuSign phishing","tags":["docusign","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"eventHandler","is_inline":false,"md5":"55d41bf1762ab367e34869095adc637a","sha1":"a971c369972c389b280912b9f0c0cf3732694b8d","sha256":"90cafbf1ac4ef47a2ef629011d29aae0bac2c7d96f05506c1df4f5646c417925","sha512":"71c77c6f6c8528716d50dc83abea2ed1fca8a3743f463e39807695a694a82b680806902a621ec0fd4e2479b19d3a7834ac3d62a516ec1f6544cf850beb9cba7a","ssdeep":"","tlshash":"c7200000000000000000030000000000c0000000000000000000000000030000000000","size":3,"data":"","first_seen":"2023-11-26T01:58:04Z","last_seen":"2026-07-20T08:17:49.612678Z","times_seen":5132,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85578,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T10:22:58.784425Z","times_seen":292979,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"185bdd46e45e10c5a47fc64c57a727db","sha1":"a0611e044a601dc921b244a791e836a51c2c5faa","sha256":"ae30730268295eda3dc89447b1a29d5e5c8640676286532a07aa0ec0930280c0","sha512":"753dd7e37fedd219d29d1876b6eafc1bd834fd605a877b03f05eeb9a9a66f8b809ae11b622b0441e0cb64863c6a6df15259db4562f84a779dabdad9a45ea8995","ssdeep":"","tlshash":"2241efe7724e05741aeb51f636668b8c3a3d400f2e0198847d6c94189b30e9b7dfe6da","size":2092,"data":"","first_seen":"2026-06-10T01:16:34.338655Z","last_seen":"2026-06-25T10:31:42.012716Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b8001e3a343e4b917ebe16af9a35f93b","sha1":"5f934943321f71d85298a17a7215cec8fd08b3f2","sha256":"77addafe830af9b64b02fc39fad22aa6e5e2db9484e4b56f95546d87052f89a2","sha512":"bbb32d7e863bc0813a00815d2c2e91aa3c8c5428aab65ce2d0aeb69e5ef001428108324793ee645bad25706ce7b5636918e41a5d30f02af8b62ff238be1fb228","ssdeep":"","tlshash":"9941de97b1a3087046afb1aa4d7bd74830b0910b2d05c904b92c9161af36f97b5bfbc9","size":1935,"data":"","first_seen":"2026-06-10T01:16:34.339699Z","last_seen":"2026-06-25T10:31:42.01388Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-10","alert":"Detects file containing Telegram Bot API","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"185bdd46e45e10c5a47fc64c57a727db","sha1":"a0611e044a601dc921b244a791e836a51c2c5faa","sha256":"ae30730268295eda3dc89447b1a29d5e5c8640676286532a07aa0ec0930280c0","sha512":"753dd7e37fedd219d29d1876b6eafc1bd834fd605a877b03f05eeb9a9a66f8b809ae11b622b0441e0cb64863c6a6df15259db4562f84a779dabdad9a45ea8995","ssdeep":"","tlshash":"2241efe7724e05741aeb51f636668b8c3a3d400f2e0198847d6c94189b30e9b7dfe6da","size":2092,"data":"","first_seen":"2026-06-10T01:16:34.338655Z","last_seen":"2026-06-25T10:31:42.012716Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b8001e3a343e4b917ebe16af9a35f93b","sha1":"5f934943321f71d85298a17a7215cec8fd08b3f2","sha256":"77addafe830af9b64b02fc39fad22aa6e5e2db9484e4b56f95546d87052f89a2","sha512":"bbb32d7e863bc0813a00815d2c2e91aa3c8c5428aab65ce2d0aeb69e5ef001428108324793ee645bad25706ce7b5636918e41a5d30f02af8b62ff238be1fb228","ssdeep":"","tlshash":"9941de97b1a3087046afb1aa4d7bd74830b0910b2d05c904b92c9161af36f97b5bfbc9","size":1935,"data":"","first_seen":"2026-06-10T01:16:34.339699Z","last_seen":"2026-06-25T10:31:42.01388Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-10","alert":"Detects file containing Telegram Bot API","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"partner.zoom.us/wp-content/uploads/2022/05/DocuSign-Logo-Black2x.png","fqdn":"partner.zoom.us","domain":"zoom.us","tld":"us"},"ip":{"addr":"141.193.213.21","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:00.727Z","timestamp":1781054160727,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"partner.zoom.us","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 22 May 2026 13:49:37 GMT","end":"Thu, 20 Aug 2026 14:49:27 GMT"},"fingerprint":{"sha1":"F6:04:49:FF:F6:DA:DD:8C:D1:21:47:57:7C:04:17:CF:29:A6:CB:02","sha256":"D9:FF:7B:27:83:08:F0:1A:A2:41:8C:36:E3:06:43:82:82:CD:DD:35:F5:70:58:D7:60:DC:01:3C:08:7F:BD:A5"}}},"request":{"raw":"GET /wp-content/uploads/2022/05/DocuSign-Logo-Black2x.png HTTP/1.1\r\nHost: partner.zoom.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ndate: Wed, 10 Jun 2026 01:16:04 GMT\r\ncontent-type: text/html\r\nlocation: https://partner.zoom.com/wp-content/uploads/2022/05/DocuSign-Logo-Black2x.png\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=bvxpdi6W7Oq9SQWzM5j8Vq.0qzSUWOpZ36lJPvNwpik-1781054164-1.0.1.1-qH1TN3ez7vFAeW.J4yX6PQuoXKblsHjOqSogDk8IpVsR09eqrAgeX6dHw69MxSmrtkauDquvvO99rOn9B_1BtXqqKHR55g4kmE9f0O7Eenc; path=/; expires=Wed, 10-Jun-26 01:46:04 GMT; domain=.partner.zoom.us; HttpOnly; Secure; SameSite=None\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: a094874c79170b51-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/webp","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":3412,"timings":{"blocked":-1,"dns":7,"connect":1,"send":0,"wait":224,"receive":0,"ssl":3179},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"blog.cpanel.com/wp-content/uploads/2015/12/Webmail-app.png","fqdn":"blog.cpanel.com","domain":"cpanel.com","tld":"com"},"ip":{"addr":"104.26.4.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:00.737Z","timestamp":1781054160737,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cpanel.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 07 Jun 2026 23:14:58 GMT","end":"Sun, 06 Sep 2026 00:14:38 GMT"},"fingerprint":{"sha1":"F5:B1:14:B6:7F:46:1A:0C:5F:59:BC:3A:A2:45:D8:28:C5:63:C2:EC","sha256":"D7:65:B1:24:70:FE:96:2F:CE:BE:0B:DB:BC:8E:F5:15:D5:D3:A0:FE:9F:27:F9:CE:11:7C:01:BE:AC:0F:F7:E1"}}},"request":{"raw":"GET /wp-content/uploads/2015/12/Webmail-app.png HTTP/1.1\r\nHost: blog.cpanel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ndate: Wed, 10 Jun 2026 01:16:04 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://www.cpanel.net/blog\r\nstrict-transport-security: max-age=15552000; preload\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PYH4GR7u%2FpespvOiaw9cAxehhNQqYZcg%2FJi%2BAYpz%2FYnELF1yk86jAumbfB5ZnZEvtLqvzhAOY%2Ff%2BqjPeF%2BTj%2B0MklQUr%2BizuPSI7uva3aScoosL98b1R4a08KTWeMEmHFA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: a094874e7f6f56c0-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":3505,"timings":{"blocked":-1,"dns":8,"connect":16,"send":0,"wait":5,"receive":0,"ssl":3476},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.fusionsol.com/wp-content/uploads/sites/2/2023/07/banner-docusign-2-1.png","fqdn":"www.fusionsol.com","domain":"fusionsol.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:00.738Z","timestamp":1781054160738,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /wp-content/uploads/sites/2/2023/07/banner-docusign-2-1.png HTTP/1.1\r\nHost: www.fusionsol.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.pixabay.com/animation/2023/05/02/04/29/04-29-06-428_512.gif","fqdn":"cdn.pixabay.com","domain":"pixabay.com","tld":"com"},"ip":{"addr":"104.18.40.96","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:00.740Z","timestamp":1781054160740,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pixabay.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 16 May 2026 02:00:00 GMT","end":"Fri, 14 Aug 2026 02:59:57 GMT"},"fingerprint":{"sha1":"7B:D5:C0:C0:A3:95:D1:9D:BF:72:92:BC:09:03:97:A0:44:9E:B2:DE","sha256":"45:44:F4:52:EF:E0:86:1F:42:8E:D2:FA:E7:54:E1:58:D9:C9:2B:46:D9:CD:EA:36:C8:5E:C9:FA:62:6A:CE:F4"}}},"request":{"raw":"GET /animation/2023/05/02/04/29/04-29-06-428_512.gif HTTP/1.1\r\nHost: cdn.pixabay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Wed, 10 Jun 2026 01:16:00 GMT\r\ncontent-type: image/gif\r\ncontent-length: 164362\r\ncf-ray: a0948738fa36723c-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 1764573\r\ncache-control: public, max-age=31536000, s-maxage=31536000\r\netag: \"98d4e83470c1059935136026801b1441\"\r\nexpires: Thu, 10 Jun 2027 01:16:00 GMT\r\nlast-modified: Tue, 02 May 2023 04:29:08 GMT\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\ncf-bgj: imgq:85,h2pri\r\ncf-polished: ok, orig_size=164362\r\nset-cookie: __cf_bm=NtdRZkTooi56dGfM066LKHmcnCkdh4y2IqOe6CfKOF4-1781054160.8006818-1.0.1.1-vZQ4WHRrrVO0z2ydGW_hLCrVeGj0IUCUjxerKbgkDCkkO1VcGF3p7E_k83_CB4Fvo4JyjU5GGkTtUohRkPUDAd_MEFlrJbLNN0eZaOpjy5KNbKHbb0odlnGo1vXfGlzN; HttpOnly; SameSite=None; Secure; Path=/; Domain=pixabay.com; Expires=Wed, 10 Jun 2026 01:46:00 GMT\r\npriority: u=1,i\r\nx-amz-id-2: wTeu9hWTCnD9aMYccKDtlIApIExZ9pVGsgIj49PdqzC1eDQQOHiVLAr5jW9YkcXMi1iWnbzvnxE=\r\nx-amz-replication-status: COMPLETED\r\nx-amz-request-id: XBQ9EKKP3FHS3FW0\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: Z7XYlPpeHC8ITZU8S3B6qPg5RUjOSQlf\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":164362,"size_decoded":165518,"mime_type":"image/gif","magic":"GIF image data, version 89a, 500 x 500","md5":"98d4e83470c1059935136026801b1441","sha1":"c8c26c8d49c1869cc05a8e010317a228e30a80c9","sha256":"54b7b2a351d57d65cff3a9d042f4a21667cb77e2a79e1cc6fa430e82e7ab621e","sha512":"64c57ab1556fd4d5cc9d26e18f07f6409e8e982a4fa921a9b0be4e0c1f3b94b5d1e856121adf99ef64c00e5c7f22c869ac47cb644b4a13348286874347d951cd","ssdeep":"3072:CBS0fCqXdgeKBuJ4j0rDuwe+hyjnMltdXaOHniU+h8G1XXvJl6AO4C:pqXe9BuJYaykdXaOvDGxXv3VO4C","tlshash":"6af312164a5365a861ae39d970b913ccdd2f0df6a1de12329961e383663fdb19400f3b","first_seen":"2024-04-30T18:22:37Z","last_seen":"2026-07-04T20:58:03.723568Z","times_seen":11,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":13,"connect":40,"send":0,"wait":40,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"partner.zoom.com/wp-content/uploads/2022/05/DocuSign-Logo-Black2x.png","fqdn":"partner.zoom.com","domain":"zoom.com","tld":"com"},"ip":{"addr":"170.114.78.89","port":443,"asn":209242,"as":"Cloudflare London, LLC","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:04.145Z","timestamp":1781054164145,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"partner.zoom.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 17 May 2026 07:31:28 GMT","end":"Sat, 15 Aug 2026 08:31:21 GMT"},"fingerprint":{"sha1":"4D:82:5E:C6:2D:C9:C8:06:08:46:94:BB:67:E2:B3:7B:07:D0:F7:C6","sha256":"EA:8D:50:97:D6:10:15:9E:2F:15:0C:83:C5:0E:38:A2:FF:D2:6A:13:79:C7:3F:E0:F2:87:C9:15:50:F0:85:9D"}}},"request":{"raw":"GET /wp-content/uploads/2022/05/DocuSign-Logo-Black2x.png HTTP/1.1\r\nHost: partner.zoom.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 10 Jun 2026 01:16:04 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3498\r\nlast-modified: Fri, 27 May 2022 09:13:11 GMT\r\netag: \"62909627-278a\"\r\nage: 636439\r\ncache-control: public, max-age=31536000\r\nvary: accept, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\npriority: u=4;i=?0,cf-chb=(136;u=5;i=?0)\r\ncf-polished: ok, orig_size=10122\r\ncf-bgj: h2pri,imgq:100\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=qHV7Ldn3j6AIGBkPUhW3zt5P2h_wc0nJ4fdehQizpL8-1781054164-1.0.1.1-idMWlXcSCgwVYKOLBbLY_w_yiXAo0YA0VJ0L3DrKTHoskrVy0NNIcI1O0tZAUv2kn4633Wea_cqaXDl1UiWVIjC5cpcBYQVQn0yAZta7has; path=/; expires=Wed, 10-Jun-26 01:46:04 GMT; domain=.partner.zoom.com; HttpOnly; Secure; SameSite=None\r\nserver: cloudflare\r\ncf-ray: a094874e0d141525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":3498,"size_decoded":4324,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3d6fcdeb56d014e724c4d2bb2e479c1a","sha1":"1624785e58a76c201af44a2feeae31270bf9cc35","sha256":"8c1c29b2d0848cd0cda92a1766af713617707094153029bf2a10ce55abe69a9f","sha512":"b3ba10a443ac9e3c082785871f3fa6a3856e3fabf3f0c5568cdd5d6f905f50a34e88d2133a71b7831692b3395003e7f518b6a4a781744d7b9825746f1192a661","ssdeep":"","tlshash":"0a712b0a7818d04f8c4a06b72d6d7a4c41a34564d777e36e9b89a01422fd89afbc6270","first_seen":"2024-02-25T00:44:50Z","last_seen":"2026-06-25T10:31:42.006121Z","times_seen":1154,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":0,"dns":6,"connect":2,"send":0,"wait":86,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.cpanel.net/blog/","fqdn":"www.cpanel.net","domain":"cpanel.net","tld":"net"},"ip":{"addr":"104.18.35.25","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:07.772Z","timestamp":1781054167772,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /blog/ HTTP/1.1\r\nHost: www.cpanel.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=mcN6ISHMv4FEcto2TVtTTqEkL3h8crKUAgAhm0WY8ro-1781054167.364323-1.0.1.1-ZUuG_xSAlElcP__T4yqxhOqFbRqIW3AHfLxFbwUoGKkMzvVfhhdZLSdR2NJshWhJ.y25AWbYe4Lgd7iXMBZ38XQWRzP9p1uaPBEHQ_gmW24Ab5qcZJTsvzXB3HqXI3Oj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 10 Jun 2026 01:16:08 GMT\r\ncontent-type: text/html\r\ncache-control: public, max-age=15552000\r\nexpires: Mon, 07 Dec 2026 01:16:07 GMT\r\nlast-modified: Thu, 04 Jun 2026 13:23:53 GMT\r\nvary: Accept-Encoding,User-Agent,User-Agent\r\nserver: cloudflare\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=31536000\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: a09487649fa856af-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.freelogovectors.net/svg17/docusign_logo-freelogovectors.net.svg","fqdn":"cdn.freelogovectors.net","domain":"freelogovectors.net","tld":"net"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:00.735Z","timestamp":1781054160735,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdn.freelogovectors.net","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 09 May 2026 01:02:43 GMT","end":"Fri, 07 Aug 2026 01:02:42 GMT"},"fingerprint":{"sha1":"D5:A0:E6:F4:3B:7A:36:13:46:BB:57:4B:07:17:55:45:5B:99:A3:2F","sha256":"AB:C3:FF:11:51:50:AF:BD:44:97:34:6D:EC:CB:54:06:FA:3E:5F:C8:C3:13:B5:71:9E:EF:C3:9D:5F:02:7A:53"}}},"request":{"raw":"GET /svg17/docusign_logo-freelogovectors.net.svg HTTP/1.1\r\nHost: cdn.freelogovectors.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 10 Jun 2026 01:16:01 GMT\r\ncontent-type: image/svg+xml\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 1874773\r\ncdn-requestcountrycode: NO\r\nvary: Accept-Encoding\r\ncache-control: max-age=25600000\r\ncontent-encoding: zstd\r\netag: \"68c0de9d-112e\"\r\nlast-modified: Wed, 10 Sep 2025 02:12:45 GMT\r\ncdn-storageserver: NY-753\r\ncdn-fileserver: 717\r\ncdn-proxyver: 1.55\r\ncdn-requestpullcode: 200\r\ncdn-requestpullsuccess: True\r\ncdn-edgestorageid: 830\r\ncdn-cachedat: 06/10/2026 01:16:01\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncdn-requestid: 299b0f594a5d8b022b3fe3d6e137ca38\r\ncdn-cache: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":4398,"size_decoded":2698,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4d4f3a7145e5af8480f1340a6bec90e0","sha1":"563af86e7fe2ffcb11ac7d6938613859318c02bd","sha256":"5b4fab3aedcdb87fe41473acec10cdbe5b3c9430dcf9985804ed81ec821891b8","sha512":"93605a4e155cdc0cc178d2d749875230fd8e2352d345c5e4b286f31e0115b12521455ed84d24d8fa4da8abb8a82d666d67326ae2754dfed80ab34b2379fd4772","ssdeep":"96:3WfOQaNXQG714z9t+HN20V29+78axSCd8Vdr7j51lLaNsfLnd:3WfAQ3NT+1AQ8Vdr7j51lLaNsx","tlshash":"b091d772f3296dfeea8c4b7c05a86c1c35786097b16340684e9cb1b97930ed214fc923","first_seen":"2024-03-03T00:35:22Z","last_seen":"2026-06-25T10:31:42.008798Z","times_seen":466,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":-1,"dns":131,"connect":69,"send":0,"wait":157,"receive":-1,"ssl":6},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.cpanel.net/blog","fqdn":"www.cpanel.net","domain":"cpanel.net","tld":"net"},"ip":{"addr":"104.18.35.25","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:04.247Z","timestamp":1781054164247,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cpanel.net","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 07 Jan 2026 00:00:00 GMT","end":"Tue, 26 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"CE:E6:4B:D1:D7:38:59:5F:42:DC:7A:1F:BD:DB:30:61:67:81:10:AA","sha256":"25:D0:14:A7:3A:BA:86:E8:C6:26:9A:B0:C1:2D:EC:C1:27:5F:C4:AB:B7:20:6D:50:31:8E:6B:4A:7C:B8:5E:B2"}}},"request":{"raw":"GET /blog HTTP/1.1\r\nHost: www.cpanel.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ndate: Wed, 10 Jun 2026 01:16:07 GMT\r\ncontent-type: text/html\r\nlocation: https://www.cpanel.net/blog/\r\nserver: cloudflare\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nvary: User-Agent,User-Agent\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nset-cookie: __cf_bm=mcN6ISHMv4FEcto2TVtTTqEkL3h8crKUAgAhm0WY8ro-1781054167.364323-1.0.1.1-ZUuG_xSAlElcP__T4yqxhOqFbRqIW3AHfLxFbwUoGKkMzvVfhhdZLSdR2NJshWhJ.y25AWbYe4Lgd7iXMBZ38XQWRzP9p1uaPBEHQ_gmW24Ab5qcZJTsvzXB3HqXI3Oj; HttpOnly; SameSite=None; Secure; Path=/; Domain=cpanel.net; Expires=Wed, 10 Jun 2026 01:46:07 GMT\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a09487620ef656af-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T10:24:04.803362Z","times_seen":17543663,"resource_available":true,"data":null}},"time_used":3516,"timings":{"blocked":0,"dns":3,"connect":1,"send":0,"wait":401,"receive":0,"ssl":3110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","fqdn":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","domain":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","tld":"r2.dev"},"ip":{"addr":"104.18.50.34","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-10T01:15:59.259Z","timestamp":1781054159259,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.r2.dev","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 12 May 2026 06:57:47 GMT","end":"Mon, 10 Aug 2026 06:57:46 GMT"},"fingerprint":{"sha1":"24:D7:68:AF:FC:F2:DB:F6:04:47:7E:D0:7B:FF:F9:8E:74:18:97:12","sha256":"A7:D7:3C:F5:72:53:85:7E:A0:36:9A:EF:51:D0:3B:8B:FE:C9:91:D6:6C:42:05:07:D7:6C:7C:2E:4D:21:71:89"}}},"request":{"raw":"GET /doc8.html HTTP/1.1\r\nHost: pub-4e9d559e11c54314b7639d20c3d13682.r2.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Wed, 10 Jun 2026 01:16:00 GMT\r\nContent-Type: text/html\r\nContent-Length: 256123\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nETag: \"4172c40cb4efe31fcaaf0aac600747e5\"\r\nLast-Modified: Fri, 23 Feb 2024 10:10:14 GMT\r\nServer: cloudflare\r\nCF-RAY: a094872f8990b51b-OSL\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:2.2.4","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}],"data":{"size":256123,"size_decoded":256412,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (65350)","md5":"4172c40cb4efe31fcaaf0aac600747e5","sha1":"f344057bd8f667c73ed76d5ea31e102ace900a6c","sha256":"ace23562881aa0952ce89490ff59a41dab5665010509dddfde0bf41044e48c18","sha512":"b762d2b1244fb3569079f19a91f6da2aee380e4012ae2348b3977bacc2a1bbcdffb75667c54e0471c7e43c25a04fed0c0a0b997d41dfdbfae35c1d276df92b76","ssdeep":"6144:8ajpSYt72uB8zd3nuatHiuZ1aYxs7TA7V+seqIxzFJkzFCOtbXf54:8a1SYtRc33CMaoQTA7V+seq4","tlshash":"1e447a3349239c27089ec1c7581d6fda7fa5cdc746316223b07c818ca795af22d9a69f","first_seen":"2024-02-28T11:08:28Z","last_seen":"2026-06-25T10:31:42.004671Z","times_seen":198,"resource_available":true,"data":null}},"time_used":928,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":904,"receive":5,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-10","alert":"Detects file containing Telegram Bot API","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-10","alert":"Phishing Block","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"pub-4e9d559e11c54314b7639d20c3d13682.r2.dev","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - DocuSign","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with DocuSign phishing","tags":["docusign","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pub-4e9d559e11c54314b7639d20c3d13682.r2.dev/doc8.html","date":"2026-06-10T01:16:00.713Z","timestamp":1781054160713,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:37:22 GMT","end":"Mon, 10 Aug 2026 18:37:21 GMT"},"fingerprint":{"sha1":"09:D4:FC:2F:81:37:26:42:91:15:6F:27:1B:72:A7:D2:1A:FC:31:72","sha256":"E9:45:95:A3:A1:F2:6E:F0:08:73:C1:35:32:67:E6:72:BB:89:C7:27:C0:8F:D7:48:6F:0A:88:7E:8B:00:2F:B9"}}},"request":{"raw":"GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30028\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 04 Jun 2026 02:18:53 GMT\r\nexpires: Fri, 04 Jun 2027 02:18:53 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 514627\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":85578,"size_decoded":31012,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32065)","md5":"2f6b11a7e914718e0290410e85366fe9","sha1":"69bb69e25ca7d5ef0935317584e6153f3fd9a88c","sha256":"05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e","sha512":"0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db","ssdeep":"1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2","tlshash":"1e83c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T10:22:58.784425Z","times_seen":292979,"resource_available":true,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":33,"receive":35,"ssl":50},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}