{"report_id":"5f20f685-7ba2-419e-8a8a-d046f6ddcaab","version":0,"status":"done","tags":["phishing","gophish"],"date":"2026-06-10T13:13:29Z","url":{"schema":"http","addr":"docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","fqdn":"docusign-electronicsignature.remote-otp.com","domain":"remote-otp.com","tld":"com"},"ip":{"addr":"3.248.19.132","port":0,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"final":{"url":{"schema":"https","addr":"docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","fqdn":"docusign-electronicsignature.remote-otp.com","domain":"remote-otp.com","tld":"com"},"title":"Sign in to your Microsoft Account","dom":{"size":7105,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"c4323c4e1b0cb98ff4c7e5c7061fd591","sha1":"9e8740e0465c70a9547dc54dfa5e9b8dfdf15cf1","sha256":"0466de94bf52fb4246ed26394dc5d474387025b1609fc8d8396b35bb3fca7b13","sha512":"421bb6bf781a0b90504dbbbc51e4d3c2955bd9b7e40e25147f1d84fc805405b1197a29b134e2dfa58089494131a4b334897626a900dc5ad44239aa1a56330e65","ssdeep":"192:2uj2Mq+fFzR5Dl6aZOsJzHn/ohIt2ar6yO:2uqiFF5t9kL","tlshash":"94e1559661f30456664394b93be7960937a4c443860acd1d3ebc6ac8cfcaec5dc633da","dom_hash":"domhash925c8a55497d288e715e9cb4484f13a3","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","fqdn":"docusign-electronicsignature.remote-otp.com","domain":"remote-otp.com","tld":"com"},"ip":{"addr":"3.248.19.132","port":0,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-15T13:13:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"docusign-electronicsignature.remote-otp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"docusign-electronicsignature.remote-otp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Gophish Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","gophish"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Gophish Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","gophish"],"meta":null}]},"summary":[{"fqdn":"aadcdn.msauth.net","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2018-10-25","domain_rank":5248,"first_seen":"2018-11-19T10:50:03Z","last_seen":"2026-06-03T14:18:03.779347Z","alert_count":0,"request_count":3,"received_data":0,"sent_data":1907,"comment":"","tags":null,"fingerprints":null},{"fqdn":"csp.platform.cyberguru.eu","ip":{"addr":"63.33.98.224","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-04-21T07:32:20.955067Z","last_seen":"2026-06-04T13:43:18.25464Z","alert_count":0,"request_count":4,"received_data":544,"sent_data":2272,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"docusign-electronicsignature.remote-otp.com","ip":{"addr":"3.248.19.132","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"domain_registered":"2023-10-05","domain_rank":0,"first_seen":"2026-06-10T13:04:43.102388Z","last_seen":"2026-06-10T13:04:43.102388Z","alert_count":6,"request_count":2,"received_data":10604,"sent_data":1146,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Gophish Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","gophish"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","fqdn":"docusign-electronicsignature.remote-otp.com","domain":"remote-otp.com","tld":"com"},"ip":{"addr":"3.248.19.132","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"introduction_type":"scriptElement","is_inline":true,"md5":"df1dffe772370ba21336a98cc1dc88b7","sha1":"79455363d0539a20e0061ade6136993c18ed67fe","sha256":"564209611f5bb589aab97096977deee61d1de7fadbae87f3d0499b543f4ca96b","sha512":"82df27fffadbd8e2901fe375e4a9de178a3ac427d9f4a6262b266754b098a838c501243b49734c865d46156aaf5822bb569a43f08d36aa635725fe98f963aff9","ssdeep":"","tlshash":"3f21afbe329618340e9769bb2486838af560c0932c4ba0147a3d5288af94f417979bd3","size":1374,"data":"","first_seen":"2026-06-08T20:46:50.339609Z","last_seen":"2026-06-20T01:24:33.315616Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:58.750Z","timestamp":1781097178750,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://docusign-electronicsignature.remote-otp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T15:14:29.446192Z","times_seen":16713185,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"csp.platform.cyberguru.eu/csp-report","fqdn":"csp.platform.cyberguru.eu","domain":"cyberguru.eu","tld":"eu"},"ip":{"addr":"63.33.98.224","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"csp","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:58.758Z","timestamp":1781097178758,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.platform.cyberguru.eu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 22 May 2026 00:37:40 GMT","end":"Thu, 20 Aug 2026 00:37:39 GMT"},"fingerprint":{"sha1":"2C:61:5A:D4:37:64:1F:E6:30:F9:69:0F:D3:9C:87:CA:AB:AE:2F:29","sha256":"50:E7:7E:E1:C6:37:D6:11:6F:90:BC:A9:A1:C6:73:1A:30:52:C4:A3:AC:BC:1C:4E:D4:A6:3A:44:C3:00:72:DB"}}},"request":{"raw":"POST /csp-report HTTP/1.1\r\nHost: csp.platform.cyberguru.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/csp-report\r\nContent-Length: 1524\r\nSec-Fetch-Storage-Access: none\r\nOrigin: https://docusign-electronicsignature.remote-otp.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: report\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 \r\ndate: Wed, 10 Jun 2026 13:12:59 GMT\r\nstrict-transport-security: max-age=15724800; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":2228,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T15:14:29.446192Z","times_seen":16713185,"resource_available":true,"data":null}},"time_used":590,"timings":{"blocked":-1,"dns":203,"connect":36,"send":0,"wait":35,"receive":0,"ssl":314},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"csp.platform.cyberguru.eu/csp-report","fqdn":"csp.platform.cyberguru.eu","domain":"cyberguru.eu","tld":"eu"},"ip":{"addr":"63.33.98.224","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"csp","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:58.764Z","timestamp":1781097178764,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.platform.cyberguru.eu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 22 May 2026 00:37:40 GMT","end":"Thu, 20 Aug 2026 00:37:39 GMT"},"fingerprint":{"sha1":"2C:61:5A:D4:37:64:1F:E6:30:F9:69:0F:D3:9C:87:CA:AB:AE:2F:29","sha256":"50:E7:7E:E1:C6:37:D6:11:6F:90:BC:A9:A1:C6:73:1A:30:52:C4:A3:AC:BC:1C:4E:D4:A6:3A:44:C3:00:72:DB"}}},"request":{"raw":"POST /csp-report HTTP/1.1\r\nHost: csp.platform.cyberguru.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/csp-report\r\nContent-Length: 1525\r\nSec-Fetch-Storage-Access: none\r\nOrigin: https://docusign-electronicsignature.remote-otp.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: report\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 \r\ndate: Wed, 10 Jun 2026 13:12:59 GMT\r\nstrict-transport-security: max-age=15724800; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":2229,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T15:14:29.446192Z","times_seen":16713185,"resource_available":true,"data":null}},"time_used":582,"timings":{"blocked":-1,"dns":197,"connect":35,"send":0,"wait":34,"receive":0,"ssl":315},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"csp.platform.cyberguru.eu/csp-report","fqdn":"csp.platform.cyberguru.eu","domain":"cyberguru.eu","tld":"eu"},"ip":{"addr":"63.33.98.224","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"csp","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:58.767Z","timestamp":1781097178767,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.platform.cyberguru.eu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 22 May 2026 00:37:40 GMT","end":"Thu, 20 Aug 2026 00:37:39 GMT"},"fingerprint":{"sha1":"2C:61:5A:D4:37:64:1F:E6:30:F9:69:0F:D3:9C:87:CA:AB:AE:2F:29","sha256":"50:E7:7E:E1:C6:37:D6:11:6F:90:BC:A9:A1:C6:73:1A:30:52:C4:A3:AC:BC:1C:4E:D4:A6:3A:44:C3:00:72:DB"}}},"request":{"raw":"POST /csp-report HTTP/1.1\r\nHost: csp.platform.cyberguru.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/csp-report\r\nContent-Length: 1525\r\nSec-Fetch-Storage-Access: none\r\nOrigin: https://docusign-electronicsignature.remote-otp.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: report\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 \r\ndate: Wed, 10 Jun 2026 13:12:59 GMT\r\nstrict-transport-security: max-age=15724800; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":2229,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T15:14:29.446192Z","times_seen":16713185,"resource_available":true,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":194,"connect":32,"send":0,"wait":35,"receive":0,"ssl":130},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:58.752Z","timestamp":1781097178752,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://docusign-electronicsignature.remote-otp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T15:14:29.446192Z","times_seen":16713185,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"csp.platform.cyberguru.eu/csp-report","fqdn":"csp.platform.cyberguru.eu","domain":"cyberguru.eu","tld":"eu"},"ip":{"addr":"63.33.98.224","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"csp","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:58.766Z","timestamp":1781097178766,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.platform.cyberguru.eu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 22 May 2026 00:37:40 GMT","end":"Thu, 20 Aug 2026 00:37:39 GMT"},"fingerprint":{"sha1":"2C:61:5A:D4:37:64:1F:E6:30:F9:69:0F:D3:9C:87:CA:AB:AE:2F:29","sha256":"50:E7:7E:E1:C6:37:D6:11:6F:90:BC:A9:A1:C6:73:1A:30:52:C4:A3:AC:BC:1C:4E:D4:A6:3A:44:C3:00:72:DB"}}},"request":{"raw":"POST /csp-report HTTP/1.1\r\nHost: csp.platform.cyberguru.eu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/csp-report\r\nContent-Length: 1525\r\nSec-Fetch-Storage-Access: none\r\nOrigin: https://docusign-electronicsignature.remote-otp.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: report\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 \r\ndate: Wed, 10 Jun 2026 13:12:59 GMT\r\nstrict-transport-security: max-age=15724800; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":2229,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T15:14:29.446192Z","times_seen":16713185,"resource_available":true,"data":null}},"time_used":615,"timings":{"blocked":-1,"dns":196,"connect":34,"send":0,"wait":68,"receive":0,"ssl":316},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"docusign-electronicsignature.remote-otp.com/favicon.ico","fqdn":"docusign-electronicsignature.remote-otp.com","domain":"remote-otp.com","tld":"com"},"ip":{"addr":"3.248.19.132","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:59.696Z","timestamp":1781097179696,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.remote-otp.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Dec 2025 00:00:00 GMT","end":"Wed, 09 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AF:9A:87:11:EC:8B:1A:EA:89:B5:6E:5E:E5:A6:C4:81:5B:19:F8:20","sha256":"CB:BF:22:97:75:0C:3B:CB:21:AE:0F:A8:F1:42:4A:A3:24:D7:DC:FB:DD:14:E3:E5:8E:1B:5C:34:4E:02:DA:23"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: docusign-electronicsignature.remote-otp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 10 Jun 2026 13:12:59 GMT\r\ncontent-type: text/html\r\ncontent-length: 604\r\nlast-modified: Mon, 08 Jun 2026 13:32:48 GMT\r\netag: \"6a26c480-25c\"\r\naccept-ranges: bytes\r\ncontent-security-policy-report-only: default-src 'self' data: https://*.cyberguru.it https://*.cyberguru.eu ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.cyberguru.it https://*.cyberguru.eu https://cdn.cyberguru.it https://player.vimeo.com https://cyberguru1.statuspage.io https://code.jquery.com https://cdnjs.cloudflare.com https://*.bootstrapcdn.com https://cdn.jsdelivr.net https://unpkg.com; style-src 'self' 'unsafe-inline' https://*.bootstrapcdn.com https://unpkg.com https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; media-src 'self' data: blob: https://*.cyberguru.it https://*.cyberguru.eu; worker-src 'self' blob:; img-src 'self' data: https://*.cyberguru.it https://*.cyberguru.eu https://cdn.platform.cyberguru.eu https://*.vimeocdn.com; connect-src 'self' https://*.cyberguru.it https://*.cyberguru.eu https://rustici.platform.cyberguru.eu https://metrics.articulate.com https://vimeo.com https://*.vimeo.com https://*.vimeocdn.com; frame-src 'self' blob: https://*.cyberguru.it https://*.cyberguru.eu https://player.vimeo.com https://*.statuspage.io; report-uri https://csp.platform.cyberguru.eu/csp-report\r\nstrict-transport-security: max-age=15724800; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":604,"size_decoded":2042,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (604), with no line terminators","md5":"a40be97faebbbad163a21185c46a477b","sha1":"06446905b0ee9287325605aaa75f8e5e44b44c74","sha256":"99e96a50ecb1e9e98c060473f36cce73b47116e7275a4497dda00c70061370a3","sha512":"b3250c9f1ff7453acbabf803f62589f0b1bd8e957f6bfbb4e767cb96b6310bb24f93213a80d61f3a9fe361f7f572719ca90b31d91aafc60872138c632508e00e","ssdeep":"","tlshash":"3af0e183cc20949e57705e95ae71f31ec88aae4c9b21dcc075f591bd19e0fc98d5bc54","first_seen":"2026-06-08T20:46:50.338763Z","last_seen":"2026-06-22T13:40:17.393571Z","times_seen":59,"resource_available":true,"data":null}},"time_used":42,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"docusign-electronicsignature.remote-otp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"docusign-electronicsignature.remote-otp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Gophish Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","gophish"],"meta":null}]}},{"url":{"schema":"https","addr":"docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","fqdn":"docusign-electronicsignature.remote-otp.com","domain":"remote-otp.com","tld":"com"},"ip":{"addr":"3.248.19.132","port":443,"asn":16509,"as":"AMAZON-02","country":"Ireland","country_code":"IE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-10T13:12:57.771Z","timestamp":1781097177771,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.remote-otp.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 09 Dec 2025 00:00:00 GMT","end":"Wed, 09 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"AF:9A:87:11:EC:8B:1A:EA:89:B5:6E:5E:E5:A6:C4:81:5B:19:F8:20","sha256":"CB:BF:22:97:75:0C:3B:CB:21:AE:0F:A8:F1:42:4A:A3:24:D7:DC:FB:DD:14:E3:E5:8E:1B:5C:34:4E:02:DA:23"}}},"request":{"raw":"GET /ID74591NF/html/ap0785185?rid=oFMAfF5 HTTP/1.1\r\nHost: docusign-electronicsignature.remote-otp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Wed, 10 Jun 2026 13:12:58 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 1913\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-server: gophish\r\ncontent-security-policy-report-only: default-src 'self' data: https://*.cyberguru.it https://*.cyberguru.eu ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.cyberguru.it https://*.cyberguru.eu https://cdn.cyberguru.it https://player.vimeo.com https://cyberguru1.statuspage.io https://code.jquery.com https://cdnjs.cloudflare.com https://*.bootstrapcdn.com https://cdn.jsdelivr.net https://unpkg.com; style-src 'self' 'unsafe-inline' https://*.bootstrapcdn.com https://unpkg.com https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; media-src 'self' data: blob: https://*.cyberguru.it https://*.cyberguru.eu; worker-src 'self' blob:; img-src 'self' data: https://*.cyberguru.it https://*.cyberguru.eu https://cdn.platform.cyberguru.eu https://*.vimeocdn.com; connect-src 'self' https://*.cyberguru.it https://*.cyberguru.eu https://rustici.platform.cyberguru.eu https://metrics.articulate.com https://vimeo.com https://*.vimeo.com https://*.vimeocdn.com; frame-src 'self' blob: https://*.cyberguru.it https://*.cyberguru.eu https://player.vimeo.com https://*.statuspage.io; report-uri https://csp.platform.cyberguru.eu/csp-report\r\nstrict-transport-security: max-age=15724800; includeSubDomains\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7132,"size_decoded":3343,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"14a321f658dd17259527558520de8e09","sha1":"f72e2bf65b28ac63d29183aef3e3821f83c48959","sha256":"fcec6e917e71c6811816e0edf1f94e4e8aacb8a66168afb9b83e9c11d7e13427","sha512":"f01131758f6da45a0e0b14f62a0864be2339d4cbef0d317fbf68c8e99b0dc2084536b89581244c05859db8147d1bc43dfa0f0d730cc99b115b08f620aad53381","ssdeep":"192:+uj2Mq+fFzR5Dl6aZOsJz0n/5K3G4ar6yO:+uqiFF5t6AV","tlshash":"3de1449665f30456264394b93be7960937a4c443870acd1d3ebc6ac8cfcaec59c633da","first_seen":"2025-06-26T11:05:57.516382Z","last_seen":"2026-06-10T13:13:30.134551Z","times_seen":34,"resource_available":true,"data":null}},"time_used":379,"timings":{"blocked":-1,"dns":12,"connect":36,"send":0,"wait":215,"receive":0,"ssl":115},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"docusign-electronicsignature.remote-otp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-10","alert":"Sinkholed","trigger":"docusign-electronicsignature.remote-otp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Gophish Phishing Kit","verdict":"phishing","severity":"high","comment":"","tags":["phishing","gophish"],"meta":null}]}},{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5","date":"2026-06-10T13:12:58.748Z","timestamp":1781097178748,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://docusign-electronicsignature.remote-otp.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-25T15:14:29.446192Z","times_seen":16713185,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}