{"report_id":"5c76ea33-d53f-4b72-ac58-03fbc5e45fa3","version":6,"status":"done","tags":["wetransfer","phishing","financial","suspicious","telegram_bot"],"date":"2026-04-09T13:29:04Z","url":{"schema":"http","addr":"wetransfer0.uk/","fqdn":"wetransfer0.uk","domain":"wetransfer0.uk","tld":"uk"},"ip":{"addr":"35.157.26.135","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"wetransfer0.uk/","fqdn":"wetransfer0.uk","domain":"wetransfer0.uk","tld":"uk"},"title":"WeTransfer","dom":{"size":12523,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"1a477fd5c0fbfca2cff91cf535e4acbe","sha1":"be0ccdac10ab1d755095bf1cf0caa03fb23af1a8","sha256":"9891942bc172362c757ab6decc749fd7eeddbf830bdbc25c762639dad95ba7d0","sha512":"a9c4a25a7fafd00dfaa529221addb24402b75d6b98673077976629e4d41860060c893ae1ac938dcf07b3b2ef67eb188cc67c44444533150e59ba2a734a9fa269","ssdeep":"192:295wG9qSFDETooaYJy0moihyTJIhf0CT4ij55If9pF3e41lTIEFtFQN8VbCaR380:QoSiFOhMaIF3e41dlFtFQ109","tlshash":"4b4295a775b314221597d1a13bf397077a21c107ad07c9683eac4794cf8df8698bb398","dom_hash":"domhash97d272afb45d43a208f3ff84203210e6","first_seen":"2026-04-09T12:27:39.992057Z","last_seen":"2026-04-09T13:29:05.590616Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wetransfer0.uk/","fqdn":"wetransfer0.uk","domain":"wetransfer0.uk","tld":"uk"},"ip":{"addr":"35.157.26.135","port":0,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-14T13:29:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-09","alert":"Detects file containing Telegram Bot API","trigger":"wetransfer0.uk/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"img.icons8.com","ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"domain_registered":"2011-10-04","domain_rank":218854,"first_seen":"2017-05-26T09:10:54Z","last_seen":"2026-04-02T14:19:29.442587Z","alert_count":0,"request_count":4,"received_data":5133,"sent_data":1783,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}]},{"fqdn":"wetransfer0.uk","ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"domain_registered":"2026-04-08","domain_rank":0,"first_seen":"2026-04-09T12:27:36.404959Z","last_seen":"2026-04-09T12:27:36.404959Z","alert_count":10,"request_count":2,"received_data":17116,"sent_data":918,"comment":"","tags":null,"fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"images.unsplash.com","ip":{"addr":"151.101.66.208","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2013-05-29","domain_rank":86676,"first_seen":"2015-08-06T06:03:25Z","last_seen":"2026-04-08T13:38:10.748921Z","alert_count":0,"request_count":1,"received_data":382097,"sent_data":493,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"wetransfer0.uk/","fqdn":"wetransfer0.uk","domain":"wetransfer0.uk","tld":"uk"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"md5":"ae82a6a9de07aa3afc025b3ba3c1005f","sha1":"e4af19f9f9519329d451c97ebf920fb1f65e18e2","sha256":"c860f161f90f876d959ae22acfad51e6c50fbea94f344211e7b5b5ed588eb604","sha512":"418855f690eaad9ba0c8499c22a2e078c0d110ea276bd0dee4654494ad57325cff510387b52360663374d2f1bb3d19d0809320e20ac2a4587ce72d72e6d86f12","size":4436,"token":"8631622354:AAGyO-JDFqnXzgdZdI3lyKspnsSDVcMkYGY","is_revoked":false,"bot":{"token":"8631622354:AAGyO-JDFqnXzgdZdI3lyKspnsSDVcMkYGY","user_id":"8631622354","username":"Kendo_Marv_bot","first_name":"Kendo","last_name":"","chat":{"chat_id":"6834228020","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"wetransfer0.uk/","fqdn":"wetransfer0.uk","domain":"wetransfer0.uk","tld":"uk"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"ae82a6a9de07aa3afc025b3ba3c1005f","sha1":"e4af19f9f9519329d451c97ebf920fb1f65e18e2","sha256":"c860f161f90f876d959ae22acfad51e6c50fbea94f344211e7b5b5ed588eb604","sha512":"418855f690eaad9ba0c8499c22a2e078c0d110ea276bd0dee4654494ad57325cff510387b52360663374d2f1bb3d19d0809320e20ac2a4587ce72d72e6d86f12","ssdeep":"96:CpF3e41lTqzEFtF0uF5KEo8VbW2yaeg38tjs9Ri:CpF3e41lTIEFtFQN8VbCaR38Vs9Ri","tlshash":"fe91655b367319300adfe56a276ba7047531800b3d06c8457e5d83164f68f9aa4be3dd","size":4436,"data":"","first_seen":"2026-04-09T12:27:40.007755Z","last_seen":"2026-04-09T13:29:05.603388Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-09","alert":"Detects file containing Telegram Bot API","trigger":"wetransfer0.uk/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"img.icons8.com/color/40/powerpoint.png","fqdn":"img.icons8.com","domain":"icons8.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wetransfer0.uk/","date":"2026-04-09T13:28:41.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1004834818.rsc.cdn77.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Mar 2026 10:28:54 GMT","end":"Mon, 15 Jun 2026 10:28:53 GMT"},"fingerprint":{"sha1":"FB:64:A2:47:3E:78:7C:2B:08:A4:67:CE:63:64:D8:05:DB:13:E1:97","sha256":"C1:67:9B:EC:6A:3F:76:AE:75:5D:0E:0F:46:34:13:71:3C:89:7C:17:5F:88:7D:0A:92:61:16:3F:C9:67:77:54"}}},"request":{"raw":"GET /color/40/powerpoint.png HTTP/1.1\r\nHost: img.icons8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wetransfer0.uk/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 09 Apr 2026 13:28:41 GMT\r\ncontent-type: image/png\r\ncontent-length: 403\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: icon-id, icon-size, icon-format\r\nicon-id: 13625\r\nicon-size: 40\r\nicon-format: png\r\nlast-modified: Tue, 31 Mar 2026 17:45:47\r\nversion: 0.0.29\r\nfrom-mongo-cache: false\r\nfrom-redis-cache: true\r\nnot-found-platform: false\r\ncache-control: public, max-age=302400\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-77-nzt: k9c9QCyQ1uqoL8FYO/8Nr6jIlu7byiMuAUR+3V8wjfGwoQ74/h5WhL+fMHpxqhb73A\r\nx-77-nzt-ray: e2f75420460a471889a9d769a2314a13\r\nx-77-cache: HIT\r\nx-77-age: 51815\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":403,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"b4a06eaafac8adefb643ab9350a401eb","sha1":"99783c57c3036a928b87b68b722b568d63de178b","sha256":"2b56a59f833376ec35803f057716650ea5c1fefbdfa01cebd5b984387804bbbb","sha512":"48df36572036729e1c9014309dbe42d7cb15267f63ffdc0e886816ee20e5c4efdbb4f03b226032d208abf878170d827363319c1a7f46f4a8f2501d7aea8efb9d","ssdeep":"","tlshash":"0ae0f1efbbf17eb8f9f2f71e03cb4a90b46615245435a009c0a28c719c91438405cbc1","first_seen":"2026-04-09T12:27:40.004109Z","last_seen":"2026-04-09T13:29:05.592254Z","times_seen":2,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":54,"dns":20,"connect":14,"send":0,"wait":34,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wetransfer0.uk/favicon.ico","fqdn":"wetransfer0.uk","domain":"wetransfer0.uk","tld":"uk"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wetransfer0.uk/","date":"2026-04-09T13:28:41.441Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer0.uk","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 07:19:31 GMT","end":"Wed, 08 Jul 2026 07:19:30 GMT"},"fingerprint":{"sha1":"78:CC:C2:0E:89:2B:A6:A4:E8:FB:1F:DD:B6:EA:AA:C7:E6:D3:DB:70","sha256":"95:6D:5A:30:3F:B3:DF:74:B5:20:BE:F9:BA:38:C3:11:83:20:41:B5:8D:AB:07:75:2A:79:00:80:79:FB:A7:EF"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: wetransfer0.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wetransfer0.uk/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nage: 17052\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Thu, 09 Apr 2026 13:28:41 GMT\r\netag: 1775689116-ssl-df\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KNS6WG7A4TVH79CGME936EWT\r\ncontent-length: 1203\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3449,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0f89e18d0abacb99149c5e59bf69b5e1","sha1":"9e1ebb10be890c5855eec444233c028270d3e65a","sha256":"8514f0009a58c6e0acb5468f88037732b59b70af5e524f452e3bef8fb33effc5","sha512":"5275d80f3f8f1f5e0d1b6b6b0745732a69d669d66dcdab418fc5a2094bffcb81ff1d34252c97c6dffe5470f0d359a3be03cfd3dfe3d729bf186917c8cf21ece0","ssdeep":"","tlshash":"1f61848dc9a7209b5c93643e27eb560a2274a247cd46da4c3fde6348cf492f214d36ac","first_seen":"2024-12-12T10:00:11.490986Z","last_seen":"2026-08-11T12:19:47.816905Z","times_seen":14236,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null}]}},{"url":{"schema":"https","addr":"images.unsplash.com/photo-1470770841072-f978cf4d019e?auto=format\u0026fit=crop\u0026w=1920\u0026q=80","fqdn":"images.unsplash.com","domain":"unsplash.com","tld":"com"},"ip":{"addr":"151.101.66.208","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wetransfer0.uk/","date":"2026-04-09T13:28:43.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images.unsplash.com","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q3","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 12 Aug 2025 01:21:13 GMT","end":"Sun, 13 Sep 2026 01:21:12 GMT"},"fingerprint":{"sha1":"46:28:F0:69:6F:53:FC:9F:BA:6A:73:37:D0:D7:C8:87:AE:06:47:7A","sha256":"80:93:A2:9A:83:84:21:A8:A0:ED:D9:72:A8:E3:4D:EC:8E:A5:E4:4B:42:68:17:09:AA:D6:6C:7C:1B:9D:2A:48"}}},"request":{"raw":"GET /photo-1470770841072-f978cf4d019e?auto=format\u0026fit=crop\u0026w=1920\u0026q=80 HTTP/1.1\r\nHost: images.unsplash.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wetransfer0.uk/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nx-imgix-id: fd733ac11dd5ad11d1eec104ad6101cb58740c7f\r\ncache-control: public, max-age=31536000\r\nlast-modified: Sat, 04 Apr 2026 06:37:46 GMT\r\nserver: imgix\r\ndate: Thu, 09 Apr 2026 13:28:44 GMT\r\nage: 456658\r\naccept-ranges: bytes\r\ncontent-type: image/avif\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nx-served-by: cache-fra-etou8220067-FRA, cache-hel1410033-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept, User-Agent\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 381469\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":381469,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"a73fa3be353aef2fbec556657edc88d8","sha1":"99f251a5d78ef23a2226f56a89e73b31d29a8aa6","sha256":"0fe1e7cd7b8f6675c1aa5f9245b36faa664703d998f59902376f2aaa1790c890","sha512":"0d9feb56277ba607998ce6003d729a0eec52f3e7de764be2d75b28b8da2b2533e2df6549cedee054c61439b7ee23da83c44c73d87e02411bed763e6bcf841268","ssdeep":"6144:HrTB4Lx+AFILObRl2oFBxU5oDBZOJrMNz3cjAfxxgI/jvgfz2XBBNzeCDTb9/L1o:HR4kXKbRl2orG4ZOWxVZ/I2XHN6s/xmb","tlshash":"db8422e494f81a26ea6a04b107388e516c72cfc5c3f39cd76d00f96aabd904964ddb63","first_seen":"2026-04-09T12:27:39.998029Z","last_seen":"2026-04-09T13:29:05.594196Z","times_seen":2,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":77,"dns":15,"connect":27,"send":0,"wait":28,"receive":94,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wetransfer0.uk/","fqdn":"wetransfer0.uk","domain":"wetransfer0.uk","tld":"uk"},"ip":{"addr":"35.157.26.135","port":443,"asn":16509,"as":"AMAZON-02","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-09T13:28:40.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wetransfer0.uk","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Apr 2026 07:19:31 GMT","end":"Wed, 08 Jul 2026 07:19:30 GMT"},"fingerprint":{"sha1":"78:CC:C2:0E:89:2B:A6:A4:E8:FB:1F:DD:B6:EA:AA:C7:E6:D3:DB:70","sha256":"95:6D:5A:30:3F:B3:DF:74:B5:20:BE:F9:BA:38:C3:11:83:20:41:B5:8D:AB:07:75:2A:79:00:80:79:FB:A7:EF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wetransfer0.uk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nage: 17056\r\ncache-control: public,max-age=0,must-revalidate\r\ncache-status: \"Netlify Edge\"; hit\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Thu, 09 Apr 2026 13:28:41 GMT\r\netag: \"0e92db3bdb42de42983f263f54c2f2fd-ssl-df\"\r\nserver: Netlify\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-nf-request-id: 01KNS6WFVDH0HZWXG573N2VGE3\r\ncontent-length: 3592\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12796,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"44b78ab0cd755162cc55d3d78bbd25c5","sha1":"b9903a7125678961e98b7d8fa2c2e17444589c38","sha256":"a87318219237f05a6c1e6c30f754957026444734393257dae2a286dd877b1397","sha512":"4a571ae9333c72fe772f973032c014822c5be1947a19724a3ce8910a5a42dc462eba84f7cda3bee5167553d7c4e0f69cabc9ef6c1be6c56dbbb7e23a7227d912","ssdeep":"192:PxJy2hXaoLrx+mo1QbCy/bT49EhMRCCFpS0igHGFkFma4unrS9rTfOOf:ZfsSCyn+FpS0iKGFkFmkrYf","tlshash":"104283637142241115b7d3a17fb3874aff118107aa0282693eec53964fbef4588bbb98","first_seen":"2026-04-09T12:27:40.000078Z","last_seen":"2026-04-09T13:29:05.59508Z","times_seen":2,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":77,"dns":21,"connect":23,"send":0,"wait":24,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-09","alert":"Detects file containing Telegram Bot API","trigger":"wetransfer0.uk/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-04-09","alert":"Sinkholed","trigger":"wetransfer0.uk","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - WeTransfer","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with WeTransfer phishing","tags":["wetransfer","phishing","financial"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"img.icons8.com/color/40/word.png","fqdn":"img.icons8.com","domain":"icons8.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wetransfer0.uk/","date":"2026-04-09T13:28:41.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1004834818.rsc.cdn77.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Mar 2026 10:28:54 GMT","end":"Mon, 15 Jun 2026 10:28:53 GMT"},"fingerprint":{"sha1":"FB:64:A2:47:3E:78:7C:2B:08:A4:67:CE:63:64:D8:05:DB:13:E1:97","sha256":"C1:67:9B:EC:6A:3F:76:AE:75:5D:0E:0F:46:34:13:71:3C:89:7C:17:5F:88:7D:0A:92:61:16:3F:C9:67:77:54"}}},"request":{"raw":"GET /color/40/word.png HTTP/1.1\r\nHost: img.icons8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wetransfer0.uk/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 09 Apr 2026 13:28:41 GMT\r\ncontent-type: image/png\r\ncontent-length: 635\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: icon-id, icon-size, icon-format\r\nicon-id: 13624\r\nicon-size: 40\r\nicon-format: png\r\nlast-modified: Mon, 23 Mar 2026 10:22:49\r\nversion: 0.0.29\r\nfrom-mongo-cache: false\r\nfrom-redis-cache: true\r\nnot-found-platform: false\r\ncache-control: public, max-age=302400\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-77-nzt: kxE8XL1elGrxQvotqa1tT6Emo2YASoG5Am6OC5t3sYKXP3pEIUo74QvJWz1I\r\nx-77-nzt-ray: e2f75420460a471889a9d76973101f13\r\nx-77-cache: HIT\r\nx-77-age: 64361\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":635,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"e07c616db3cee6451ca2e958ddec5919","sha1":"89dcc12cfbc579da6a674dba96ba018917e889f1","sha256":"5b1b93663147f9618e02c55c827a74312f54b2d440de1d50a5625dbcb524c2d7","sha512":"2f5c6192a79c50ae5ad55d24c0b872f5e4dff1b0a619329d8e8febb6e9afa5eb8564ee15e9bdd64e276c2df21fe7fb6a1acf812e24172102814c6c49aa48df0a","ssdeep":"","tlshash":"22f08393322a84b10f101823dc83a31c58c6083f83a8ad8814345d629c9e8ab6b883e9","first_seen":"2026-04-09T12:27:39.994763Z","last_seen":"2026-04-09T13:29:05.595872Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":52,"dns":21,"connect":7,"send":0,"wait":35,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.icons8.com/color/40/microsoft-excel-2019.png","fqdn":"img.icons8.com","domain":"icons8.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wetransfer0.uk/","date":"2026-04-09T13:28:41.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1004834818.rsc.cdn77.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Mar 2026 10:28:54 GMT","end":"Mon, 15 Jun 2026 10:28:53 GMT"},"fingerprint":{"sha1":"FB:64:A2:47:3E:78:7C:2B:08:A4:67:CE:63:64:D8:05:DB:13:E1:97","sha256":"C1:67:9B:EC:6A:3F:76:AE:75:5D:0E:0F:46:34:13:71:3C:89:7C:17:5F:88:7D:0A:92:61:16:3F:C9:67:77:54"}}},"request":{"raw":"GET /color/40/microsoft-excel-2019.png HTTP/1.1\r\nHost: img.icons8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wetransfer0.uk/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 09 Apr 2026 13:28:41 GMT\r\ncontent-type: image/png\r\ncontent-length: 652\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: icon-id, icon-size, icon-format\r\nicon-id: 117561\r\nicon-size: 40\r\nicon-format: png\r\nlast-modified: Mon, 15 Sep 2025 13:08:17\r\nversion: 0.0.29\r\nfrom-mongo-cache: false\r\nfrom-redis-cache: true\r\nnot-found-platform: false\r\ncache-control: public, max-age=302400\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-77-nzt: k6PR0V2LRPFDb52AQZYvSJrg5y37qGrY8kq3dR2NTpGk2X2RGEmHix9Wb3jd\r\nx-77-nzt-ray: e2f75420460a471889a9d76943270c13\r\nx-77-cache: HIT\r\nx-77-age: 134516\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":652,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"17894233f7c93cfc263765a189a791df","sha1":"f9c9ab7902102147d50cdec88c59dab29ab750d5","sha256":"c8e93b791710f70d8f6c5d5c5d565111425a6c02abe4978e19cdedecd46b8b73","sha512":"7551b8aac5c30a0c58bffe01209cd874b42a1622b31b213d4e0de3832f14318902d4b5f414e34ba5c114070f3aa1b4572ae3dceae540576f5ac59fd47542800a","ssdeep":"","tlshash":"93f023f0b7c4017d6ea415a713840553ec5f14b4123a3caac676adf1bb0ca281b2e3d5","first_seen":"2026-04-09T12:27:40.002302Z","last_seen":"2026-04-09T13:29:05.60122Z","times_seen":2,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":53,"dns":22,"connect":7,"send":0,"wait":34,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.icons8.com/color/40/pdf-2.png","fqdn":"img.icons8.com","domain":"icons8.com","tld":"com"},"ip":{"addr":"185.76.9.11","port":443,"asn":60068,"as":"Datacamp Limited","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wetransfer0.uk/","date":"2026-04-09T13:28:41.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1004834818.rsc.cdn77.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Tue, 17 Mar 2026 10:28:54 GMT","end":"Mon, 15 Jun 2026 10:28:53 GMT"},"fingerprint":{"sha1":"FB:64:A2:47:3E:78:7C:2B:08:A4:67:CE:63:64:D8:05:DB:13:E1:97","sha256":"C1:67:9B:EC:6A:3F:76:AE:75:5D:0E:0F:46:34:13:71:3C:89:7C:17:5F:88:7D:0A:92:61:16:3F:C9:67:77:54"}}},"request":{"raw":"GET /color/40/pdf-2.png HTTP/1.1\r\nHost: img.icons8.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wetransfer0.uk/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 09 Apr 2026 13:28:41 GMT\r\ncontent-type: image/png\r\ncontent-length: 537\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: icon-id, icon-size, icon-format\r\nicon-id: 13593\r\nicon-size: 40\r\nicon-format: png\r\nlast-modified: Mon, 26 May 2025 14:00:25\r\nversion: 0.0.29\r\nfrom-mongo-cache: false\r\nfrom-redis-cache: true\r\nnot-found-platform: false\r\ncache-control: public, max-age=302400\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-77-nzt: k12O6Qxfg6tzIl+0aKGyDbB0PlrBQuCdBa4EP+QPo29i+qTZ5FZHQ0+MPtyKMbmdQg\r\nx-77-nzt-ray: e2f75420460a471889a9d7697d082613\r\nx-77-cache: HIT\r\nx-77-age: 95196\r\nserver: CDN77-Turbo\r\nx-77-pop: stockholmSE\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"CDN77","description":"CDN77 is a content delivery network (CDN).","website":"https://www.cdn77.com","common_platform_enumeration":"","icon":"CDN77.png","categories":["CDN"]}],"data":{"size":537,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"6a3e3e5f1ecc6c6ec9324bfbb1a15cdb","sha1":"0e5d4821bd00eaad33a8fdeab0a37c52f57d4e84","sha256":"c7a5dd3575ff6d13c3966667eab03823f3b050900c3cf44c9ef895f38a08d4ac","sha512":"09d873518d7ebf847e41b97ba45d209217ff0fd6a4ce8475fbe19949f1b313e1d4039473f1b01a72f032ef7b05a21c2277a9679a19f8ea21d6d3812827dca16a","ssdeep":"","tlshash":"eaf020c3a39540bac866006301d606b4a87b80b92662a8d8d0428c5d6f1bcdca35c7d6","first_seen":"2026-04-09T12:27:40.005825Z","last_seen":"2026-04-09T13:29:05.602044Z","times_seen":2,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":54,"dns":20,"connect":11,"send":0,"wait":38,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}