{"report_id":"58aeee81-7637-4168-8b4d-40099a777e66","version":0,"status":"done","tags":["microsoft","phishing"],"date":"2026-08-24T01:49:40Z","url":{"schema":"http","addr":"tucsongrs.org/ars","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":0,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"tucsongrs.org/c1269b06-fca6-4b69-8106-0ef2c361c182","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"title":"Outlook Web App","dom":{"size":548608,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65488)","md5":"82684f91b6f78d411d6c3e7c0be344c1","sha1":"b36f2df5ee0a77e007540be41a4d35586d0cd55b","sha256":"86065b314b603e7fee83253191bae36d0526d3a6e9da5a8b2fbc2eb1d679ab01","sha512":"ac94e239ecc7fffe7fe9158e4833f4e030b03d0c084441439834f314e1bc535fbf26511c93c2d3f71b540edc43a629143a695693cf8e988955fa62b6aca4c850","ssdeep":"6144:jkUdYAvvakXps0hu9dDWYxMZZmDFniosbWZGSZ1Vad2s0gh:JZvvUMun9xMXbWE","tlshash":"bfc4672c38e4d0abf016303bba55ca88e9647c16af86c975701d795c678507fae37cb2","dom_hash":"domhashc828a7ebf5a1ffa7666f07a0821f27d8","first_seen":"2026-08-06T15:51:55.363739Z","last_seen":"2026-08-24T02:00:18.682727Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tucsongrs.org/ars","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":0,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-28T01:49:40Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"tucsongrs.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"mxhdjr.com","ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2026-06-09","domain_rank":0,"first_seen":"2026-06-15T11:59:34.268716Z","last_seen":"2026-08-20T17:37:05.199862Z","alert_count":0,"request_count":2,"received_data":116802,"sent_data":1042,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"tucsongrs.org","ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"domain_registered":"2005-06-20","domain_rank":5309668,"first_seen":"2026-08-24T01:46:11.708054Z","last_seen":"2026-08-24T01:46:11.708054Z","alert_count":4,"request_count":2,"received_data":397,"sent_data":971,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"tucsongrs.org/c1269b06-fca6-4b69-8106-0ef2c361c182","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"22ff28339d0cb3532f19f8e6347797da","sha1":"e779f04588b4fcbd7da66d115520d22efb291d0c","sha256":"e3e928fed487fe20d976acee91a9e32573d91ca3111552d398cf525b21aec2dc","sha512":"cd57082b4751e4a972c0c252221e6bc31e8d389d2d6016251126c05d5db66aa22e417b14ea0e2270184c243c84fa10d19d5deb47a9e19620b88c908a13e266ce","ssdeep":"6144:NkUdYAvvakXps0hu9dDWYxMZZmDFnioso:jZvvUMun9xMXo","tlshash":"53a4332c38e4d0abf01a303bba55ca8ce9647c15af86c976601d795c658507fbe37cb2","size":486056,"data":"","first_seen":"2026-08-06T15:51:55.374038Z","last_seen":"2026-08-24T02:00:18.688411Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e97b837fbc1f6f75f01642f8ada1d68d","sha1":"d65c9157c0bd6392a7d307040d139911d165a001","sha256":"8bfc629e1270cede6354471c5e290226ccef3dd3b2211b3be5675ce693423951","sha512":"70e0c94c6855ac988c43e0b0f94a908601e9fc552d14968f4c760181e800388595709e9ef2a9755c25f8db9f288183b19f36ea7c0ed66295674d9640da9098b9","ssdeep":"192:TzsY/lSrYvtF73U6qwSEKmn4nGS14WiXiZnXlbz9IW3WHcwBYpYRixjCCd5WB:vPtmvLfiXiZ1n9ILQEixjy","tlshash":"0f22222decf995331c63e47a078f7148f3658817e309cc093c2ea764af4556646be6ca","size":10463,"data":"","first_seen":"2024-08-19T12:47:28.007876Z","last_seen":"2026-08-24T02:00:18.685241Z","times_seen":38,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"52ba7c53b3c5e52f398f0791cdfc3511","sha1":"d187447120b2bab0ab044d2f7108ed522b88faf9","sha256":"a2b38019e4d84386273c2153e17401713a00b444da7b2fc023c2562d6a21d14e","sha512":"33d4c699ad3500704372c1a763ddd4973d9b3962debd41d28b057a30c0fbbd82dd9928ed3a63f5f28479b44484353949dc7d9e7804ef6936b07b7609cc2e9c88","ssdeep":"","tlshash":"3580000bc20002c0a22a823f08c0002c23200003e03a0c20200000a00a2002c2002220","size":31,"data":"","first_seen":"2024-01-19T15:54:51Z","last_seen":"2026-08-24T02:00:18.689588Z","times_seen":117,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b10d5f358d8599d84e3de0574747804e","sha1":"8afab108e0ece90968549ff805d1a4048db211c3","sha256":"c51b81148d87a9477bffd19158fabed6043ff792da3311cd5776cdf3056cd6cc","sha512":"f50a630a5585333e5fcba259f73ceb7f16e03b3f56a50901c4dccc1ebe4b5a8f8a57299bf6eaf9d4cf0d5637977f8baf148bc9152cdb8c5fe4674456e632490c","ssdeep":"","tlshash":"2dc04c59ea4206a41ab6b67d32df110537418043db05f48c747de1018b109834478f8c","size":179,"data":"","first_seen":"2024-01-19T15:54:51Z","last_seen":"2026-08-24T02:00:18.686746Z","times_seen":117,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"43d9b225855b41782f44c555d84ce01c","sha1":"00f46e079a68a352299fabb82e15d470e094d594","sha256":"027272807b83592078d5f32dfd8086a3079fb15c39b60b058442b3c7d531fca8","sha512":"55da779d653da76f0601d3a7c8875ab76d30d0583dc4e71c21617f22cc891497527afb67e1cf1760d15dcd7ed96ea2e93529dcf874054a8e45932dcd0dd5d58b","ssdeep":"96:z2ijXimJI4EuMEQucynoH4dH3zXeRUBmWn5/Mn5V2ysqctNPkekBkEqsLtV+dvvo:5dMhynoY13zdqk5IFBxqmV+dveiCX","tlshash":"e6c1200da5f211b21b23b07967af724931b2551b1c8bd9143c4d83491fa8c7a1df5bde","size":5623,"data":"","first_seen":"2026-08-06T15:51:55.384522Z","last_seen":"2026-08-24T02:00:18.687802Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7cb5bad3ea88ffc675606a076f1f1161","sha1":"f349cbcf63836a55435bf4fc853912b2dc6d4cb6","sha256":"98aeff545d29fb93be0c5274ba8443dfae892564d2bcd0b83b792da33d3a5b75","sha512":"82eb2f5e745d97f74aa4ef99ec0d6bdc39d8074d387219de248910a76a61f98a3e374aa83e42883e0263b2ee5763ffaf76e527af6ab8c62ec09d4330a9263235","ssdeep":"","tlshash":"6e31324eb6721272be03993b97df605073a48927c21dcc15306e1bf26f86428117e7a7","size":1823,"data":"","first_seen":"2024-01-19T15:54:51Z","last_seen":"2026-08-24T02:00:18.685791Z","times_seen":117,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ae0b69a20642340e8ed2e60e4b900b9c","sha1":"f78d8c41c23285594b86540167cf2ae2b568954d","sha256":"976adf5b493e997df460c3718d02f74e92afe0e82fe5cd9f106041aea09d8975","sha512":"29a925e13e5fffec410e72dba9a0779294cf906dddc11673d4a9d8cb68c3b2c1c7b4f28ccfc2cd75d2b2cc86a1cf6d7d5931c34586e6548be7e894275a393057","ssdeep":"","tlshash":"7d31d86a7447092079eef63d126a678c3939c013850699003dbcd71e6f36ec7c4a9eee","size":1729,"data":"","first_seen":"2024-01-19T15:54:51Z","last_seen":"2026-08-24T02:00:18.686278Z","times_seen":117,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0473db55488d2816e2f616a20ca2f10a","sha1":"f6314c1890634047e24f329f15d857f9fa831b62","sha256":"48bfe428b2a8b27cace40da455dde5a0601ff19800370ea0294ea525719ee365","sha512":"d62fb8b0936c5c4f3c817f3d8bb5463a7ec1c7d47d966db47efa2c8f165d6bdd48c4a3fafe61db6cb6fc0ba700546d523456f6a6b56801ec967207ca9e9cbbdf","ssdeep":"","tlshash":"afc0020cc4af42510e1be93d25e6cc4c52535453e1a69715780c03469f418a485b1ad5","size":147,"data":"","first_seen":"2024-06-19T16:54:07Z","last_seen":"2026-08-24T02:00:18.687271Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mxhdjr.com/app/owausername/media/download.gif","fqdn":"mxhdjr.com","domain":"mxhdjr.com","tld":"com"},"ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tucsongrs.org/ars/","date":"2026-08-24T01:49:14.864Z","timestamp":1787536154864,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mxhdjr.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:BD:B0:D9:CB:F8:4F:8D:5E:D9:9F:24:21:53:47:60:18:E3:8F:05","sha256":"B3:DB:A7:27:FC:BF:16:F1:AC:25:6C:ED:B8:77:DC:3F:6F:30:32:76:36:CF:33:1F:39:69:71:48:8F:10:17:46"}}},"request":{"raw":"GET /app/owausername/media/download.gif HTTP/1.1\r\nHost: mxhdjr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Mon, 31 Aug 2026 01:49:15 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 06 Jun 2025 22:06:44 GMT\r\naccept-ranges: bytes\r\ncontent-length: 108283\r\ndate: Mon, 24 Aug 2026 01:49:15 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":108283,"size_decoded":108628,"mime_type":"image/gif","magic":"GIF image data, version 89a, 362 x 362","md5":"be0d9fd5a1c00a70c7cc41abd73709ff","sha1":"62394a9d43bbffaaa117c0baca9e10d41c397097","sha256":"2b491e2211f7003c16a9132d78a95753e0315bf30b1977518d65e3a76dccec20","sha512":"ea92a5825ce15c80f83e44cea54a5474aa55b734c268e2179628ef6c5fa4f79288a662c2716c6953bfe236645613dbcfc050a71ac6963f92dcf2c28f8e6090e9","ssdeep":"3072:SuYszn//XvDWmLz34AdakjsNKDoWqb5Z6xNt:/VnHCmN8UCKDoBb5ZwNt","tlshash":"f3b301019a6e4e9bee7534bc323e2a11978423ec2dd9f67f95e0b7422fe52605690c07","first_seen":"2023-07-02T06:06:02Z","last_seen":"2026-08-24T02:00:18.684194Z","times_seen":455,"resource_available":false,"data":null}},"time_used":728,"timings":{"blocked":-1,"dns":61,"connect":110,"send":0,"wait":110,"receive":327,"ssl":120},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mxhdjr.com/app/owausername/media/favicon.ico","fqdn":"mxhdjr.com","domain":"mxhdjr.com","tld":"com"},"ip":{"addr":"64.187.97.204","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tucsongrs.org/ars/","date":"2026-08-24T01:49:14.967Z","timestamp":1787536154967,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mxhdjr.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Jun 2026 00:00:00 GMT","end":"Thu, 24 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:BD:B0:D9:CB:F8:4F:8D:5E:D9:9F:24:21:53:47:60:18:E3:8F:05","sha256":"B3:DB:A7:27:FC:BF:16:F1:AC:25:6C:ED:B8:77:DC:3F:6F:30:32:76:36:CF:33:1F:39:69:71:48:8F:10:17:46"}}},"request":{"raw":"GET /app/owausername/media/favicon.ico HTTP/1.1\r\nHost: mxhdjr.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncache-control: public, max-age=604800\r\nexpires: Mon, 31 Aug 2026 01:49:15 GMT\r\ncontent-type: image/x-icon\r\nlast-modified: Fri, 06 Jun 2025 22:06:43 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7886\r\ndate: Mon, 24 Aug 2026 01:49:15 GMT\r\nserver: LiteSpeed\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7886,"size_decoded":8174,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"759fade9033aa298629e4b000dcd6dde","sha1":"34a1adf5c7326d7bde5b5735471b5d81e611c189","sha256":"cf0808a61ec571e0c4975663903b288009d55502ac0445d9948983b339a5cf6e","sha512":"e96e93b13d70420d4d509d89a6337651440ae049b2a23d57c6250987003c46512c40c85c41bfa1c473a704801c961ffbe421522b89a1c34ba3b9e82a6d0769ed","ssdeep":"48:g8KokgDQoxTP0Vh0jV/H2kPxL6GUEtcrCOmgfzQumtGCzYoITin0iarrWtwVWsiw:97DdTGhGW6yS7Kvs/WjiUKqWmNQOWY","tlshash":"0cf130334afb6800e6171df04556f774c16a2d16394e58c3d88c3a6ae037be6706a9ef","first_seen":"2023-05-01T18:01:52Z","last_seen":"2026-08-24T06:11:23.325822Z","times_seen":5734,"resource_available":false,"data":null}},"time_used":517,"timings":{"blocked":0,"dns":0,"connect":110,"send":0,"wait":291,"receive":1,"ssl":115},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tucsongrs.org/ars","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-24T01:49:13.015Z","timestamp":1787536153015,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tucsongrs.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:31:51 GMT","end":"Wed, 14 Oct 2026 11:31:50 GMT"},"fingerprint":{"sha1":"1E:E3:4C:F3:11:72:5C:20:AF:D1:BF:E4:33:53:48:20:79:4F:EF:80","sha256":"FE:7E:9B:64:DB:02:FB:45:EF:0C:8A:66:61:7D:B6:DA:9E:88:7A:B4:14:53:F7:C5:62:40:1E:F9:A3:35:A1:8F"}}},"request":{"raw":"GET /ars HTTP/1.1\r\nHost: tucsongrs.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\nlocation: https://tucsongrs.org/ars/\r\ncontent-length: 274\r\ncontent-type: text/html; charset=iso-8859-1\r\ndate: Mon, 24 Aug 2026 01:49:13 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-24T06:40:41.819557Z","times_seen":18069727,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"tucsongrs.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"tucsongrs.org/ars/","fqdn":"tucsongrs.org","domain":"tucsongrs.org","tld":"org"},"ip":{"addr":"67.23.254.2","port":443,"asn":33182,"as":"DIMENOC","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-24T01:49:13.732Z","timestamp":1787536153732,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tucsongrs.org","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 11:31:51 GMT","end":"Wed, 14 Oct 2026 11:31:50 GMT"},"fingerprint":{"sha1":"1E:E3:4C:F3:11:72:5C:20:AF:D1:BF:E4:33:53:48:20:79:4F:EF:80","sha256":"FE:7E:9B:64:DB:02:FB:45:EF:0C:8A:66:61:7D:B6:DA:9E:88:7A:B4:14:53:F7:C5:62:40:1E:F9:A3:35:A1:8F"}}},"request":{"raw":"GET /ars/ HTTP/1.1\r\nHost: tucsongrs.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Sun, 23 Aug 2026 10:27:04 GMT\r\naccept-ranges: bytes\r\ncontent-length: 652418\r\ncontent-type: text/html\r\ndate: Mon, 24 Aug 2026 01:49:13 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-24T06:40:41.819557Z","times_seen":18069727,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-24","alert":"Sinkholed","trigger":"tucsongrs.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}